diff --git a/go/client/chat_svc_handler.go b/go/client/chat_svc_handler.go
index <HASH>..<HASH> 100644
--- a/go/client/chat_svc_handler.go
+++ b/go/client/chat_svc_handler.go
@@ -9,6 +9,7 @@ import (
 
 	"github.com/araddon/dateparse"
 	"github.com/keybase/client/go/chat"
+	"github.com/keybase/client/go/chat/attachments"
 	"github.com/keybase/client/go/chat/utils"
 	"github.com/keybase/client/go/libkb"
 	"github.com/keybase/client/go/protocol/chat1"
@@ -615,6 +616,9 @@ func (c *chatServiceHandler) DownloadV1(ctx context.Context, opts downloadOption
 	if opts.Output == "-" {
 		fsink = &StdoutSink{}
 	} else {
+		if err := attachments.Quarantine(ctx, opts.Output); err != nil {
+			c.G().Log.Warning("failed to quarantine attachment download: %s", err)
+		}
 		fsink = NewFileSink(c.G(), opts.Output)
 	}
 	defer fsink.Close()
quarantine through stream download path CORE-<I> (#<I>)