How to Check a Custom GPT Before Using It
2026-10-27
In late September 2026 a Custom GPT titled "Plus 5.6" answered every prompt with a notice that the service had limited availability and sent users on to a "backup domain". The GPT itself sat on the genuine chatgpt.com address, so the URL bar looked right. Huntress published its write-up on September 28, 2026 and updated it on October 14.
According to Huntress, it responded to at least 40 incidents tied to the campaign's Google Sites page, and two of them came through a Custom GPT. OpenAI took the first GPT down on September 25; a new one was found on September 27. The backup page ended in a request to paste a command into a terminal, and that paste is what installs the malware. This page stays on the defensive side: how to vet a GPT you did not write.
An address on an official domain says who runs the server, not who wrote the GPT. Anyone with an account can publish a Custom GPT and write its instructions.
Four ways to vet a GPT
Start from the address you typed. What it does: removes the sponsored-result route, which was the entry point in this campaign. How to use it: type the product address yourself, then search for the GPT inside it. Limit: the GPT you find there is still unvetted; this only fixes where you came from.
Take the link from the author. What it does: ties the GPT to a person or project you can check elsewhere, such as a documentation page or a repository. How to use it: open the link from that page, not from a search result or from inside another GPT. Limit: it proves nothing if the author page is itself unknown, so look for a history, not just a name.
Read what the GPT asks of you. What it does: catches the behavior that matters, whatever the GPT is called. How to use it: stop at any reply that reports an outage and offers a "backup domain", asks you to solve a CAPTCHA by pasting text, or asks you to download an installer or extension. A chat has no reason to ask you to run commands. Limit: a careful attacker can wait several messages before asking, so keep the rule for the whole conversation.
Limit what it can reach. What it does: caps the damage if you misjudge. How to use it: do not upload private files or enter passwords and API keys into a GPT you have not vetted, and keep secrets out of the instructions of your own GPTs. Limit: it protects your data, not your computer; a pasted command runs with your account's rights.
| Approach | Covers | Does not cover |
|---|---|---|
| Typed address | Ads and lookalike links | A hostile GPT found inside |
| Author link | Unknown authors | A trusted author's account being misused |
| Reading the requests | Any GPT, any name | Slow, patient lures |
| Limiting access | Data you would have shared | Commands you run yourself |
If a command already ran
Do not clean it by hand and stop there. The Huntress post says the Run value and the scheduled task it found recreate each other, so the process has to be killed first and both entries removed after. That is incident-response work for whoever maintains the machine. If that is you, treat the computer as compromised: disconnect it from the network, change important passwords from a different, clean device, and plan a reinstall.
Choosing
Use the first and third ways every time, since they cost nothing. Add the second for any GPT you will rely on, and the fourth for anything that touches work files. If a GPT fails the third check, close the tab; there is nothing to gain from asking it again.