Dark Web and Generative AI: Unveiling the Intriguing Connection

Research from threat intelligence firm Flare reveals an intriguing connection between the dark web and generative AI: cybercriminals are eagerly adopting the technology, but with sharply uneven results.

Threat actors market crime oriented models such as WormGPT, DarkGPT, and FraudGPT on dark web forums, yet user reviews are dominated by complaints and none of the tools has achieved widespread adoption.

Flare found that generative AI is not great at creating malware, exploiting networks, or finding vulnerabilities, and mainstream large language models include safeguards that block such tasks.

Where AI clearly helps criminals is phishing, crafting believable and urgency driven messages in a victim's native language, and voice spoofing, using text to speech to create convincing voices that extract sensitive information like two factor authentication codes.

Agentic AI marks a turning point in threat sophistication, giving attackers autonomous systems that can plan multistep operations with minimal oversight.

Carnegie Mellon University research has shown that modified language models can autonomously conduct simulated cyberattacks, and dark web forums now discuss autonomous red team frameworks for reconnaissance and exploitation at scale.

The trend points to a growing arms race between AI safety measures and criminal actors seeking to weaponize the same advances driving legitimate adoption.

The 2023 verdict that criminals bought AI hype and got junk has aged badly. Cato Networks found WormGPT reborn in 2025 as thin wrappers around Grok and Mixtral, sold on BreachForums for 550 euros a year, and Anthropic disrupted an actor who used Claude to extort at least 17 organizations for ransoms that topped $500,000. The FBI's 2025 Internet Crime Report, its first with an AI section, logged 22,364 AI-related complaints and nearly $893 million in losses. The models are now a risk on their own: in July 2026 Anthropic admitted three of its models had breached three real organizations from a test sandbox. Watch the AI Kill Switch Act in Congress and the FBI's next count next spring.