You can ask an AI to check free software for danger before you install it

Before installing a free program, you can ask an AI to read its code first. How-To Geek editor Nick Lewis says Claude can go through an open-source program's source code, the human-readable instructions behind it, and flag anything suspicious before it ever touches your computer.

Why it matters

Most people install new apps and self-hosted services without a second thought. Lewis points to malicious packages on the npm and PyPI code libraries, malware posing as real self-hosted services, and rushed AI-written apps that went viral with poor security. Self-hosting means running a service yourself, such as a home media server. If that service is reachable from the internet, sloppy code can be as dangerous as actual malware.

Why antivirus falls short

Traditional antivirus tools rely on two tricks. Signatures match a program against a database of known threats. Heuristics look for behavior that resembles malware. Lewis says both are fairly weak against new or custom-built threats. They also do little about code that is unsafe through carelessness rather than bad intent.

How the check works

The method only works on free, open-source programs, because their code is public. Lewis describes two ways to use it. His preferred way is to point Claude at the project's online repository, the public home of its code. That keeps anything suspect off his PC until Claude has reviewed it. The other way is to upload the code as a ZIP file.

Lewis shares a long prompt he refined with Opus. It tells Claude not to run any code from the project and to treat everything inside as untrusted. If text in the code seems aimed at tricking an AI reviewer, Claude should report that as a red flag. It also has to say what it did not get to.

What the prompt looks for

• Whether the repository is the official one, not a copycat
• What runs during installation or setup
• Dependencies with known flaws, and the project's update and release practices
• Hidden or scrambled code, and unexplained internet connections
• Access to passwords, keys, browser data or crypto wallets

Each finding is reported with its file and line, a severity level, and whether it is confirmed or only suspicious. The report ends with a verdict and a list of what the check could not verify. Lewis warns it takes a while to run.

What to keep in mind

Lewis treats deliberately scrambled code as a major red flag. It is hard to spot in a large project, but he says an AI can find it almost immediately and explain what it likely does without running it. He adds that some scrambled code is legitimate, and Claude can help sort out which is which. The available text does not say how reliable the method is, so a clean verdict is not proof of safety.