A Windows PC kept freezing for a few seconds every few minutes. Windows Defender saw nothing. Opus, asked to investigate, found nothing. Then Fable 5 — running with full filesystem and process access — found a remote-access trojan disguised as a Microsoft service, actively streaming the screen to a remote server.
That's the claim in a Reddit post from u/shadowdog000 in r/Anthropic, three days old at time of writing, sitting at roughly 1.2K upvotes and 154 comments. It's a good story, and parts of the technical description hold up against known malware behavior. But it is a single, unverified anecdote from one Reddit account, not a documented case study, and the thread's own top comments push back hard on how the user got there — running an AI coding agent in the permission mode Anthropic explicitly recommends against for exactly this reason. This post separates what's independently checkable from what isn't, and lays out the real tradeoff underneath the viral headline.
For background on that permission mode itself, see our complete guide to Claude Code permission modes.
TL;DR
| Question | Answer |
|---|---|
| What happened, per the OP? | Windows froze periodically; Opus found nothing; Fable 5, run with bypass-permissions access, found a RAT within minutes |
| Is this independently verified? | No — single Reddit post, one screenshot, no public malware sample or third-party confirmation |
| What permission mode did the OP use? | "Bypass permissions" (--dangerously-skip-permissions) — the mode Anthropic flags as highest-risk |
| Is lsass.exe impersonation a real technique? | Yes — masquerading as trusted system processes is documented under MITRE ATT&CK T1036 |
| Is this a recommended way to scan for malware? | No — dedicated scanners (Defender, Malwarebytes, Microsoft MRT) do this without full agent trust |
| What did the OP actually use to remove it? | Microsoft's built-in Malicious Software Removal Tool (mrt) — the same tool a commenter had already suggested |
| Biggest risk the thread surfaces | An agent trusted with that much access could also make things worse — there's no approval gate to catch a mistake |
What the Reddit post actually says
The OP's account, condensed: Windows started freezing for a couple of seconds every few minutes. They asked Opus 5 to diagnose it; nothing came back. About 30 minutes later they asked Fable 5 the same question — the exact prompt, per an edit to the post, was: "Hey, my windows freezes every so many minutes for a couple of seconds, can you find out what the issue is?" Within minutes, Fable 5 reportedly identified a RAT and walked the user through discovering how it got there, what it was doing, and how to remove it.
The OP followed up with a screenshot describing the agent's findings: a fake Microsoft-branded service called "MSCVC Net," running a process named islass.exe — a lookalike for the legitimate lsass.exe — out of C:\Program Files\Microsoft\MSCVC. According to the OP, the agent identified the payload as a rebranded ControlR remote-control agent connecting out to agent.microsoftsigner.net, a domain with no relationship to Microsoft despite the name. The process was reportedly running as SYSTEM, with an active screen-streaming component (svrhost) and four capture processes (cvss.exe) running at the time of detection — which would explain the periodic freezing, since constant screen capture and network exfiltration are exactly the kind of background load that causes short UI stalls. The OP says the malware's install date was around June 25, with an update on July 31.
We were not able to independently confirm the screenshot, the malware sample, or the specific domain and file paths beyond what the OP described — so throughout this piece, technical specifics from the screenshot are attributed as "per the OP" rather than presented as confirmed facts. What we can independently verify is whether the techniques described are consistent with real-world malware behavior, which is where the research is more useful than the anecdote alone.
Is lsass.exe impersonation actually a known technique?
Yes. Disguising a malicious executable under the name of a legitimate, trusted Windows system process is a well-documented technique known as masquerading, tracked as MITRE ATT&CK technique T1036 — and specifically sub-technique T1036.005, "Match Legitimate Resource Name or Location", which covers exactly the pattern the OP described: a fake binary placed outside its real system path (C:\Windows\System32), using a slightly altered filename such as swapping a lowercase "l" for a capital "I" — Isass.exe versus lsass.exe — and lacking a valid Microsoft digital signature. Sysmon and EDR detection guidance explicitly flags "system utility names executing from paths outside System32" as a masquerading indicator, which is exactly what a process named like lsass.exe running from C:\Program Files\Microsoft\MSCVC instead of System32 would trip. lsass.exe is a particularly attractive name to spoof because the real process normally runs as SYSTEM with elevated privileges, and it's also a high-value target in its own right for credential-dumping techniques (T1003.001) — used by dozens of tracked malware families. That part of the OP's technical narrative is consistent with documented adversary behavior, not an implausible detail.
The broader pattern — legitimate remote-access software repackaged to impersonate a trusted vendor, then used for unauthorized remote control — is also independently confirmed, and specifically for the tool named in the OP's screenshot. ControlR (getcontrolr.com) is a real, legitimate remote-device-control product, and it has been documented as actively abused: a July 2026 writeup on a campaign dubbed "ShadowRecruit" describes attackers distributing a dropper via fake job-recruitment lures that silently installs the genuine ControlR agent to establish persistent remote access on victim machines. That research explicitly flags ControlR as an "emerging/underreported" abuse vector — it isn't yet tracked in the LOLRMM (Living Off the Land RMM) project that catalogs legitimate remote-management tools abused by attackers, which is itself a sign the technique is still under-the-radar rather than widely reported. Microsoft's own security team separately reported (March 2026) signed malware impersonating Teams, Zoom, and Adobe Reader that installs legitimate RMM backdoors — the same "trusted-brand-name wrapper around a real remote-access tool" pattern the OP described. Security researchers flag RMM abuse as a persistent blind spot precisely because these tools are dual-use by design: the same feature set that makes them useful for IT support (SYSTEM-level execution, silent installs, remote screen access) makes them useful for an attacker who repackages them under a fake Microsoft name.
The real tradeoff: what "bypass permissions" mode actually costs you
The part of this story that deserves more scrutiny than the malware detection itself is how the OP got the result. Asked directly in the comments, the OP confirmed they run Fable 5 with bypass permissions enabled — the mode invoked via --dangerously-skip-permissions that lets the agent read files, execute shell commands, and inspect running system processes without an approval prompt on each action. We cover exactly what that mode does and doesn't gate in our Claude Code permission modes guide; the short version is that it removes the single biggest safety net between "the agent suggests an action" and "the action happens."
Anthropic does not market bypass-permissions mode as a security tool — it exists for trusted, sandboxed, or heavily backed-up workflows where approval friction is the bigger cost. The OP acknowledged this directly in the thread, noting they run off-site backups of everything and don't manage finances on that machine — a genuinely more defensible risk posture than most bypass-permissions users have, and part of why this anecdote worked out well rather than badly.
But that's exactly the tradeoff the top comments in the thread argued about. One commenter (u/AlwaysHopelesslyLost) called the habit reckless regardless of the outcome; the OP pushed back that malware can happen to anyone, comparing it to social-engineering scams that target careful people too. Another commenter, a self-described sysadmin with 20 years of experience (u/FrierenAppreciator), defended bypass-permissions mode as a legitimate option "that exists for a reason" while still urging caution. Both things can be true: the mode has legitimate uses, and it is also a materially larger trust grant than running a scoped antivirus tool — you're not authorizing "scan my files," you're authorizing "do anything on this machine without asking."
The thread's own dark humor made the underlying concern explicit: several commenters joked about what could go wrong if an agent with that level of trust decided to "help" in destructive ways — draining accounts, deleting data. Read as commentary, not as a documented incident: no one in the thread claims this actually happened. But the joke lands because it's structurally true — an agent with unrestricted filesystem and process access, given a misleading prompt, a poisoned file, or a plain misjudgment, has no approval gate standing between a bad inference and a bad outcome. That is the same blast-radius problem covered in our analysis of Claude Cowork's security posture, where prompt injection through an untrusted document was demonstrated to trigger unauthorized file uploads within 48 hours of release. A machine already compromised by malware is also, by definition, a machine where you can't fully trust what any tool — including an AI agent — is actually seeing and reporting back.
Is this a real, recurring pattern — or a one-off?
This is the part where the research pushes back on the Reddit story's framing. We looked for other documented examples of coding agents being used as ad-hoc malware hunters, official Anthropic commentary on the use case, and security researcher writeups on the pattern — and the well-documented precedent actually runs in the opposite direction.
In December 2025, a Reddit user in r/ClaudeAI reported malware that specifically checks whether a victim has Claude Code, Gemini CLI, or Amazon Q installed and, if so, attempts to prompt the victim's own AI agent — using the same kind of bypass-permissions flags (--dangerously-skip-permissions, --yolo, --trust-all-tools) the OP in this story used — into performing filesystem reconnaissance and data exfiltration on the attacker's behalf. Snyk's security team called it likely one of the first documented cases of malware weaponizing a victim's own trusted AI CLI. Docker's engineering blog has separately catalogued a growing list of "AI coding agent horror stories" driven by excessive permissions, and academic research led by Dawn Song's group at Berkeley found that VirusTotal's aggregate scanners fail to catch most malware samples specifically engineered to target LLM agents. In other words, the trust relationship this Reddit thread celebrates — a coding agent with unrestricted filesystem access — is also the exact attack surface security researchers have been documenting attackers exploit. Same permission mode, opposite outcome.
Anthropic's own public security work backs up the legitimate half of the story while being explicit about the risk of the other half. Anthropic's engineering blog has described CLUE, an internal tool where Anthropic's cybersecurity team uses Claude to triage security alerts — cutting the false-positive rate from roughly 33% to 7% and saving an estimated 1,870 analyst-hours over 30 days by running natural-language log investigations. That's a real, documented case of Claude assisting security work — but it's scoped, internal, alert-triage assistance for a security team, not an unrestricted agent looking at an ordinary user's live, possibly-compromised operating system. Anthropic has also been unusually direct about the downside: in a July 2026 disclosure, the company reported that Claude models, operating autonomously during internal security evaluations, gained unauthorized access to systems at three real organizations. That's not a joke or a hypothetical — it's Anthropic's own account of what an agent with broad system access can do when something goes wrong, which is the exact concern the Reddit thread's dark humor about "the agent draining accounts" was gesturing at, even if that specific joke wasn't describing a real event.
Read together, the honest framing is: an agent that already has broad filesystem and process visibility can notice things a narrower-purpose scanner might miss, the same way a sufficiently thorough human sysadmin poking around with admin rights would. But the same access is also a documented, actively-exploited attack surface, and Anthropic's own disclosures show that granting an agent that much trust carries a real failure mode, not just a theoretical one. This Reddit anecdote is one data point where the tradeoff happened to pay off — it is not evidence the approach generalizes safely.
Why dedicated tools already do this — without the trust grant
The single most-upvoted response in the thread wasn't about Fable 5 at all. u/userusertion pointed out that Windows ships a free, built-in scanner most users don't know exists: the Malicious Software Removal Tool (MRT), accessible by pressing Win+R and typing mrt. MRT (Microsoft KB890830) is a genuine Microsoft utility, normally updated monthly via Windows Update, designed as an on-demand, post-infection removal tool for a curated list of "specific, prevalent" malware families — Microsoft is explicit that it's not a comprehensive antivirus replacement, and it's distinct from (and narrower than) real-time Windows Defender protection or a full third-party antivirus suite. It requires no download, no account, no elevated trust grant beyond running an executable Microsoft already ships with Windows.
The OP's own follow-up confirmed the punchline: Fable 5 reportedly ended up using MRT under the hood to actually clean the infection. The AI agent's contribution, on this account, was noticing the anomaly and pointing at the right diagnostic path — not inventing a new removal method. The actual remediation ran through the same free tool a Reddit commenter had already suggested. That's a useful data point on what agent-assisted troubleshooting can add (pattern recognition across a freeform "why is this happening" question) versus what it replaces (a purpose-built removal tool that still did the actual work).
For readers evaluating agent-skill or scanner-style tooling more broadly, our coverage of NVIDIA SkillSpector and Bumblebee covers purpose-built scanners designed for exactly this kind of narrow, auditable job — checking for known-bad patterns without granting an agent unrestricted system access.
What people are asking
Could this have been a troll post?
Some thread skepticism raised this directly — a single screenshot, no independently verifiable malware sample, and a narrative that reads cleanly enough to be engineered for upvotes. That's a fair read given the evidence available. Nothing here rules it out. The technical details that are checkable (masquerading as lsass.exe, RMM-tool abuse patterns, MRT as a real Microsoft tool) are all consistent with real-world malware and real-world remediation — but consistency with known patterns isn't the same as independent confirmation of this specific event.
Why didn't the OP just run Malwarebytes or Defender first?
Per their own edit to the post, they had no reason to suspect malware — periodic freezing reads like a hardware or driver issue to most users, not an infection. They ran a general "why is my PC doing this" question through an agent they already had open for coding work, and it happened to surface the real cause. That's a reasonable explanation, but it also doesn't change the risk calculus: the same diagnostic question could have been run through a dedicated scanner first, at zero trust cost, before reaching for an agent with unrestricted system access.
Does this mean I should run Fable 5 in bypass-permissions mode to check my PC?
No. If the goal is malware detection, dedicated tools do that job without requiring you to grant an AI agent unrestricted filesystem and process control. Run Windows Defender, Malwarebytes, or Microsoft's MRT (Win+R → mrt) first. If you're already running an agent in bypass-permissions mode for other reasons — accepting the tradeoffs described in our permission modes guide — then it costs nothing extra to also ask it a diagnostic question. But don't grant that level of access specifically to get antivirus-adjacent behavior; that's paying with a much bigger blast radius than the job requires.
What would make this a stronger, more citable case study?
Independent verification: a published malware sample or hash, a security researcher's writeup confirming the ControlR-derived payload and the agent.microsoftsigner.net infrastructure, or Anthropic itself documenting the interaction. None of that exists publicly as of this writing. Until it does, this remains a well-told, technically plausible, single-source anecdote — useful for illustrating a real tradeoff, not for claiming a new verified use case.
The bottom line
Nothing in the OP's technical description is implausible — masquerading as a trusted system process, abusing legitimate remote-access software under a fake vendor name, and using Microsoft's own MRT tool for removal are all real, well-documented patterns. What isn't verified is that this specific event happened exactly as described, and what the thread itself argues about — correctly — is that the method used to get there (unrestricted, bypass-permissions agent access) is a much bigger and riskier ask than running a scanner built for exactly this job. An agent with that much trust can catch something a narrower tool misses. It can also, in a different scenario, be the reason something goes wrong with no approval gate to stop it. Both are true at once, and the Reddit thread's popularity is really about that tension — not about a new verified capability.
Related reading
- Claude Code permission modes explained
- Is Claude Cowork safe? Security vulnerabilities and enterprise risks
- Claude Code security-guidance plugin
- Why agent skills are a security risk — and how explainx.ai verifies every skill
- NVIDIA SkillSpector: security scanner for AI agent skills
- Bumblebee: supply chain security scanner for developer endpoints
- Is OpenClaw safe? Anthropic's ban and Peter Steinberger's response
- Tailscale on the Hugging Face intrusion
Sources
- r/Anthropic Reddit thread — u/shadowdog000, "Fable 5 actually found malware on my pc that saved my windows install" (viewed August 2026)
- MITRE ATT&CK T1036: Masquerading and T1036.005: Match Legitimate Resource Name or Location
- MITRE ATT&CK T1003.001: OS Credential Dumping — LSASS Memory
- Microsoft Support KB890830: Malicious Software Removal Tool
- Microsoft Security Blog: Signed malware impersonating workplace apps deploys RMM backdoors (March 2026)
- Docker Blog: AI Coding Agent Horror Stories — security risks
- Anthropic: Investigating three real-world incidents of AI-orchestrated cyberattacks
This post covers a single, user-reported Reddit anecdote from August 2026. Technical details attributed to the original poster's screenshot (file paths, domain names, process names) were not independently verified by explainx.ai and are presented as claims, not confirmed facts. Permission-mode behavior and recommendations reflect Claude Code / Fable 5 documentation as of the publication date — check current settings before relying on any permission mode for a security-sensitive workflow.