AI hacking tools: what criminals sell, what testers use, and what changes for defense
AI hacking tools fall into two groups. Criminal tools such as WormGPT variants and KawaiiGPT are wrapped or jailbroken models sold or shared to write phishing and basic malware; researchers found their output rudimentary but convincing. Authorized AI pentest tools test systems their owner approved and must prove each finding. For defense, the main change is more volume and better-written phishing, aimed at old weaknesses.
AI hacking tools are AI models packaged to help someone attack computer systems. They come in two groups: criminal tools sold or shared to write phishing and malware, and testing tools that security teams use on systems their owner has authorized.
This page covers what research teams found when they tested the criminal tools, how the two groups differ, and what defenders should change. It does not explain how to get or use criminal tools.
What AI hacking tools do criminals sell?#
The best-documented ones are WormGPT variants and KawaiiGPT. Each was tested by a named research team, and the results are below.
Criminal AI tools in published research
| Tool | What it is | What researchers got from it | Their verdict |
|---|---|---|---|
| WormGPT 4 (Unit 42, November 2025) | Sold on Telegram and forums from around 27 September 2025; Unit 42 lists 50 US dollars a month or 220 for lifetime access with source code | A PowerShell script that encrypts PDF files, with optional exfiltration over Tor; a ransom note; convincing business email compromise text | Output called "rudimentary"; the makers "neither confirm nor deny" whether it is a fine-tuned or jailbroken model |
| KawaiiGPT (Unit 42, November 2025) | Free on GitHub, version 2.5; set up in under five minutes on most Linux systems | A spear-phishing email; a Python script for lateral movement over SSH; a script that searches for email files and sends them out | "A rudimentary capability"; automates standard steps, adds nothing hugely new |
| WormGPT variants on BreachForums (Cato CTRL, reported June 2025) | Wrappers around commercial models (xAI's Grok and Mistral's Mixtral) with a system prompt telling the model to ignore its guardrails | Phishing emails and PowerShell credential-stealing code on request | Largely uncensored front ends to existing models |
Google's Threat Intelligence Group (GTIG) describes the wider market. It wrote that in 2025 the underground market for AI tools "matured", with multifunctional tools for phishing, malware development and vulnerability research. It also wrote that "almost every notable tool" advertised phishing support.
How capable are these tools?#
Less capable than their marketing, and still useful to a low-skill attacker. The research reports agree on three points:
- The code is basic. Unit 42 called both tools' output rudimentary. The scripts automate steps that attackers already ran by hand.
- The writing is good. WormGPT 4 produced messages that "persuasively mimics a CEO or trusted vendor". Unit 42 wrote that defenders "can no longer rely on the classic warning signs of poor grammar or sloppy coding".
- The skill bar is lower. GTIG wrote that these tools let "low-level actors" raise "the frequency, scope, efficacy, and complexity" of intrusions.
GTIG compared generative AI for skilled actors to "the use of Metasploit or Cobalt Strike": a framework that speeds up known work. Unit 42 also notes that self-reported user counts are unverified, and that defenders cannot yet measure how many attacks used these tools. So treat claims about the size of this market with care, in either direction.
The tools are also only as good as the model under them. The Cato CTRL finding shows that some sellers put a new name on a commercial model and a prompt that removes its rules. When the model provider closes the account or improves its refusals, the tool can stop working.
How do criminal AI tools differ from AI pentest tools?#
The code can look alike. The difference is the authorization, the controls and the output.
| Criminal AI hacking tool | Authorized AI pentest tool or service | |
|---|---|---|
| Target | Anyone's systems | Only systems the owner approved in writing |
| Controls | None, or guardrails removed on purpose | Written scope; rules that allow, hold for approval, or block each tool |
| Output | Phishing text, malware, stolen data | Findings, each with evidence and a fix |
| Proof of a claim | Not required | Request, response and an observed effect for each finding |
| Who checks the result | No one | A person reviews the evidence before the report |
If a product you are evaluating cannot fill in the right-hand column, treat it as a risk to your systems. The AI pentest tools guide has five questions to ask any vendor.
What should defenders change because of AI hacking tools?#
Expect more attacks of known kinds, written better. The tools in these reports produce phishing, credential theft and basic ransomware, so the defenses are the established ones, applied with less tolerance for gaps:
- Phishing-resistant sign-in. Better-written lures defeat the grammar check, so rely less on users spotting them. Passkeys or hardware keys resist credential phishing.
- Script execution controls. Several samples were PowerShell or Python scripts. Limit who and what can run them on endpoints.
- Payment and vendor-change checks. Business email compromise text is now easy to produce. Confirm bank-detail changes through a second channel.
- Your exposed web apps and APIs. GTIG lists vulnerability research and exploitation among advertised features. Known flaw classes in your app become cheaper to find, for attackers and for you.
Item 4 is the one a pentest covers. Our AI testing agents check web apps and APIs against the OWASP Web Security Testing Guide classes, under written scope and per-tool rules, and Excession Labs checks each finding before it reaches the report. The production safety page lists those rules. If you want your app tested before someone else's tool reaches it, request a scoped test.
Where do tools that test AI systems fit?#
Some products sold as AI hacking tools attack AI models: jailbreaks, prompt injection, data leaks from chatbots. That is a different job from using AI to test a normal app. For tests of LLM apps, agents and RAG systems, see AI red teaming.
Questions about the agents
Is WormGPT still available?
Unit 42 reported WormGPT 4 on sale from around 27 September 2025, through Telegram and underground forums. Offers change, and we do not track them. Treat any tool sold for crime as illegal to use against systems you do not own.
Are AI hacking tools legal?
Owning or writing security software is legal in many countries, and using it without authorization usually is not. Pentest tools are used under a written authorization from the system owner. Tools sold for fraud or malware carry legal risk for buyers. Ask counsel for your country.
Which AI hacking tools do pentesters use?
Mostly tools built for authorized testing: LLM assistants, open-source agents such as PentestGPT, and commercial AI pentest platforms. Our AI pentest tools guide sorts 12 named products into four types by who runs them and who checks the results.
Sources
- Unit 42 (Palo Alto Networks): The dual-use dilemma of AI, malicious LLMs (25 November 2025) (checked 11 November 2026)
- Google Threat Intelligence Group: Advances in threat actor usage of AI tools (5 November 2025) (checked 11 November 2026)
- CyberScoop: Researchers say AI hacking tools sold online were powered by Grok, Mixtral (17 June 2025), reporting Cato CTRL research (checked 11 November 2026)
- OWASP Web Security Testing Guide (checked 11 November 2026)