AI Tool Safety
Fake AI tools, malicious extensions, and why AI-generated scams are harder to spot
Fake 'premium AI tool' phishing sites
You search for 'ChatGPT free' or 'Midjourney alternative' and land on a site that looks identical to the real product. It asks for your Google/email login to 'sign in.' That login goes directly to a scammer.
🚩 Red flags:
- •URL is not the official domain (e.g. 'chatgpt-pro.net' instead of chat.openai.com)
- •Offers a 'free premium' version of a paid tool
- •Asks you to log in with Google/Apple without the real OAuth screen
- •Download links for 'desktop app' from unofficial sites
✅ Rule: Always go directly to the official URL. For AI tools: chat.openai.com, claude.ai, midjourney.com, gemini.google.com. Bookmark these.
Malicious browser extensions posing as AI tools
Extensions labelled 'ChatGPT for Chrome,' 'AI Writer Pro,' or 'YouTube Summary with AI' often appear in search results and are even available on the Chrome Web Store. They ask for permission to 'read all site data' — then harvest your passwords, cookies, and banking sessions.
🚩 Red flags:
- •Extension requests permission to 'read and change all data on all websites'
- •Very few reviews, recent upload date
- •Developer is a personal Gmail account, not a company
- •Advertised as 'free premium access' to a paid AI service
✅ Rule: Only install AI extensions from verified developers with thousands of reviews. Most legitimate AI tools work in a browser tab — you don't need an extension. When in doubt, don't install.
AI-generated scam messages are harder to spot now
Traditional phishing emails were obvious: broken English, generic greetings, odd formatting. AI lets scammers generate fluent, personalised, grammatically perfect messages in any language. The old 'it looks weird' heuristic no longer works reliably.
🔍 What to check instead:
- →Check the sender's actual email domain (not just the display name)
- →Hover over links before clicking — does the URL match what you'd expect?
- →Verify unexpected requests through a different channel (call the person/organisation directly)
- →Treat urgency as a red flag regardless of how professional the message looks
✅ Rule: Content quality is no longer a reliable signal of legitimacy. Switch to sender verification and URL checking as your primary filters.