Fake model 'Plus 5.6' on chatgpt.com installs a trojan on Windows PCs
Attackers built a Custom GPT named 'Plus 5.6' and promoted it through sponsored Google results for searches for 'ChatGPT'. The GPT directs you to a 'backup domain' with a fake Cloudflare check that asks you to paste a command into Windows (ClickFix), after which PowerShell installs a remote access trojan. Security company Huntress saw at least 40 incidents linked to that page; OpenAI removed the first GPT on 25 September, but on 27 September a new one with the same name appeared.
What does this mean? A 'model' with 'by a community builder' is not an official OpenAI version: never let colleagues paste commands offered by a website or chatbot, and open ChatGPT via a bookmark rather than an advert.
Alert Online: half of Dutch employees use private AI for work
According to Alert Online's behavioural study 2026, 49 per cent of employees sometimes, often or always use a private AI account or app for work. 35 per cent use AI tools without their employer's permission, and only 39 per cent know which AI tools are permitted at work.
What does this mean? Work and client data in private accounts falls outside your business agreements and data processing agreement: as an organisation, make clear which tools may be used and offer a business alternative.
Nextens: financial professionals consult AI more often than the Tax Authorities
In a Nextens survey of over 800 financial decision-makers, 51.5 per cent say they use AI tools such as ChatGPT, Copilot and Perplexity for tax and financial information, compared with 46.5 per cent who consult the Tax Authorities. 61.4 per cent usually check AI answers against a second source. 53.6 per cent are unaware of the AI literacy obligation in Article 4 of the EU AI Act, and only 6.4 per cent have fully trained their staff.
What does this mean? If you use AI for tax questions, check the answer against the source and make sure your team meets the mandatory AI literacy requirement.
Bits of Freedom: no AI model fully refuses human rights violations
Research by Aithos, shared by Bits of Freedom, put eight scenarios that push towards human rights violations, such as discrimination in education and fraud screening, to seven models (Claude, ChatGPT, Grok, Gemini, DeepSeek, Mistral and Kimi). No model refused completely; Claude refused in 96 per cent of cases, Mistral in 11 per cent. Bits of Freedom calls for European AI rules that better protect human rights.
What does this mean? If you deploy a language model for decisions about people, such as screening or access to services, you must test for discrimination yourself: the model cannot be relied on to do that for you.
