Malicious Claude Artifact Ranked on Google, Dropped macOS Malware

A Reddit user says a first-page Google result for installing Claude Code was a published Claude artifact hosted on a legitimate Anthropic domain, styled to match Anthropic's own install docs. The page served a curl-pipe-to-bash command instead of documentation, per the r/ClaudeAI post.

Running it triggered a macOS password prompt and installed persistent launch agents requesting further system access. The user wiped the disk rather than try to clean it up. The post hit 170 upvotes, and the author declined to link the artifact itself, saying they didn't want to send more traffic its way, which means the specific artifact URL and how long it sat live are both unconfirmed.

The interesting failure isn't the malware. Curl-pipe-to-bash scams are old news and any security-conscious developer should eyeball a script before running it. The failure is that Google ranked an attacker's page on Anthropic's own domain, above or alongside the real docs, for a query as basic as "install Claude Code." A published artifact inherits the domain's search authority and its trust signal to a user scanning results. That's a distribution channel most developers wouldn't think to distrust.

If you publish user-generated content on a domain people already trust for something else, whether that's artifacts, gists, or app store listings, you're on the hook for policing it at the index level, not just the execution level. Sandboxing what an artifact can do when it runs doesn't stop it from looking like your own docs to someone who never runs it, just clicks the curl command straight into a terminal.

Worth watching: whether Anthropic pulls indexing on artifact pages, adds a visual trust boundary distinguishing published artifacts from first-party docs, or both. Neither showed up in what's public so far.