Got hacked yesterday. The link came from inside Claude chat.

I was installing a transcription app. Claude sent the download link, and I pasted the command into the terminal. It all looked legit.

It wasn't though.

It was a copycat site bundling malware. It ran instantly, tried to take everything from me.

Nothing sensitive got out. So I wiped the laptop and rebuilt clean.

But here's the scary part.

Restoring from the backup, I found a poisoned SKILL.md for Claude Code.

It looked exactly like my own writing style guide.

But buried inside:

it had instructions to silently re-download the malware and steal my credentials every time the AI loaded it.

If I'd restored that one file, my new clean laptop is owned on day one.

What saved me:

I read every skill, hook, and config file before letting the AI touch them.

Two lessons here:

AI assistants will hand you links they never verified. Check before you paste.

And AI agent files are executable code now, disguised as notes. You have to read them.

Stay safe out there.