A routine search for a desktop transcription application turned into a deeper security scare for Refi Hub co-founder Numa Lunah after a download link presented during a Claude AI conversation allegedly led to malware on his computer.

But this was not all, as when reviewing the files Lunah had previously stored before restoring his working environment, he found instructions for the virus in a SKILL.md configuration file, thus raising the chances that the malware had possibly been re-downloaded during his usage of the coding environment.

That second discovery is what makes the case particularly significant. Removing malware from a computer is normally expected to close the immediate breach. Here, the files preserved for recovery allegedly contained instructions capable of reopening the door.

A software recommendation inside Claude led to the first compromise

The incident began when Lunah used Claude to look for a desktop transcription application. The AI assistant returned installation guidance that included a direct software download link along with terminal commands for completing the setup.

Lunah followed those instructions and executed the terminal script. According to the account of the incident, the command redirected the system to a spoofed external domain carrying an infostealer malware package.

Once delivered, the malicious software began attempting to collect sensitive information stored on the machine. The targeted data included browser session cookies, system passwords and cryptocurrency wallet authorisation information.

This episode is a case of a security issue which gets increasingly difficult to recognize by the users when the risky action is contained within the normal flow of work done using artificial intelligence. Rather than being received via an unsolicited email or ad, the link was included in the software guidelines during an interaction initiated by the user.

Lunah wiped the machine, but the risk was not gone

After recognising the compromise, Lunah disconnected the computer from the network and carried out a factory reset of the operating system. He then reinstalled the core software components using clean source images.

That response removed the immediate infection, but his next step uncovered a more persistent problem.

Before restoring his backed-up environment, Lunah inspected the files that would be returned to the computer. Inside a SKILL.md file used to store formatting preferences, he found concealed malicious system prompts.

Those instructions were designed to make the Claude interface download the external malware payload again whenever a new coding session was started. Lunah avoided that secondary infection because he manually reviewed the contents of his custom prompt files before putting them back into use.

In practice, however, conventional remediation may not have sufficed. If the infected configuration file had been replaced without checking it, then the same environment used to get Lunah back into normal operation could have reconstituted part of the attack chain.

Why the SKILL.md discovery matters

The case draws attention to a less obvious security surface created by configuration and instruction files used in AI-assisted development.

Such files can look harmless because they often contain preferences, workflow guidance or instructions intended for an AI system. But if their contents are altered, they can potentially influence what happens when the environment is used again.

The report describes this technique as poisoning of skill files, where hidden instructions are placed inside configuration material so an AI system can be directed towards unauthorised commands or external downloads.

That means a user investigating a compromise may need to look beyond executable files and installed applications. Backups containing prompts, configuration files or AI-specific instructions may also require inspection before they are restored.

For developers in particular, that changes the recovery checklist. A clean operating-system installation does not necessarily make every previously saved file safe to reuse.

Trust in AI-generated installation steps becomes part of the attack surface

The incident also highlights a basic tension in the growing use of conversational AI for technical work.

Developers increasingly use assistants to obtain commands, troubleshoot errors and identify software. Those interactions often result in instructions that can be copied directly into a terminal. The convenience is substantial, but so is the consequence of executing an unsafe command.

In Lunah’s case, the reported chain began with an ordinary software query and moved quickly from a recommended link to a terminal command and then to an external malware payload.

The practical lesson is not that every recommendation from an AI assistant is malicious. It is that links, software packages and terminal commands produced in a chat interface still require the same scrutiny as material encountered elsewhere online.

The security guidance accompanying the incident recommends independently checking external links, confirming official domains and reviewing configuration files before executing or restoring them.

For Lunah, that final manual review appears to have made the difference between cleaning the machine once and potentially walking straight back into the same compromise.

Also Read: GTA 6 Extended Look Reveals Jason, Lucia and Leonida Gameplay