This week's scams: fake "fix your computer" commands, and an AI agent that gave out an address

The scam: "fix your computer" by pasting a command

You're on a website and a message pops up. It says something is wrong with your computer, or asks you to "prove you're human". The steps look simple: copy this line, open a box on your computer, paste it in and press Enter.

Don't. This trick is called ClickFix. Google says the command you paste is often not the one shown on the page, and it uses tools already built into your computer, like PowerShell, to download and set up harmful software. Because you run it yourself, it can slip past the protections your browser normally uses for downloads.

Google puts it plainly: Chrome will never ask you to repair it this way. Neither will a real website or a real support team.

Watch our short video on this scam

Related: scammers can also clone a voice from a short clip and call pretending to be family. Watch our short on AI voice-clone scam calls, or read AI voice-clone and deepfake scams.

Chrome's new scam warnings

Google has added new protections to Chrome's Enhanced protection setting:

• Softer "suspicious site" warnings. These appear when a page looks like known scam sites but Google isn't certain. The full red "dangerous site" page is still shown for sites known to be harmful.
• Better spotting of fake antivirus and fake update pages. Google uses its Gemini AI on its servers to check pages that show strong signs of a scam. Google says only those pages' text is sent, and it isn't kept or used to train AI.
• A warning when you copy a scam command. If you copy what looks like a ClickFix command, Chrome checks it with Google, after removing personal details, and warns you if it's dangerous.

Enhanced protection sends more information to Google than the standard setting, such as the addresses of sites you visit and small samples of pages, to check for danger. Google says this is used only for security.

The lesson: an AI agent that said too much

This one isn't a scammer, but it's a good lesson. In late September 2026, a man in Toronto let Meta's new Muse AI agent handle a keyboard he was selling on Facebook Marketplace. AP News reports that Muse accepted an offer on its own, gave the buyer his home address for pickup, and even sent a "Yep, I'm here!" message from his account when the buyer arrived. He didn't know until afterwards.

He later learned from Meta that it came down to an "always allow" permission he'd given when he first let Muse use his Marketplace profile, where he'd shared his pickup address. He thought it would still check with him before accepting offers.

An expert quoted by AP adds another warning: once an agent has seen your information, like your past card transactions, removing its access later doesn't take that back.

What to do

1. Never paste a command a website gives you. Close the page. If you're worried about your computer, ask someone you trust or contact the maker of your computer through its official website.
2. Turn on Enhanced protection in Chrome. On your computer, click the three dots at the top right, then Settings > Privacy and security > Security, and choose Enhanced protection.
3. If you already ran a command, disconnect from the internet, change important passwords from a different device, and get help from a trusted repairer.
4. If you use an AI agent, choose "allow once" rather than "allow always" until you've watched what it does.
5. Keep your home address, phone number and card out of what an agent can see, unless you're happy for it to share them.
6. Make it ask first before it sends messages, accepts offers or agrees to anything for you, and check its permissions again after a few days.

For more, see our updated guides: Getting started with AI for older Australians and Is it safe to give an AI agent your email, passwords or card?