News chronological

Halcyon studied nearly 4,000 posts across 77 Telegram channels, 20 dark web forums, and five specialized underground markets between the months of October and May.

Sellers offered access to ChatGPT Plus accounts for as little as 10 cents and jailbreak prompts designed to trick models into breaking their safeguards for as little as 32 cents. These low costs make it significantly cheaper for a wider range of individuals to acquire hacking capabilities.

The research did not find evidence of criminals selling AI systems capable of running fully autonomous cyberattacks. Instead, the AI is currently being used to perform discrete elements of existing attacks more cheaply and efficiently, such as providing coding assistance, infrastructure, and individual tasks, rather than creating and deploying malware entirely on its own.

Cybercriminals have completely commercialized the sale and creation of these tools, often utilizing software-as-a-service (SaaS) subscription models and online storefronts. Many sellers have moved from traditional dark web forums to easier-to-manage storefronts hosted on Telegram to promote and offer tools they have tested.

Hackers are selling four primary types of AI tools: 1) Jailbroken and stolen AI services, including prompts to strip safety guardrails from mainstream models for as little as $10; 2) Identity fraud and phishing tools for impersonating real people; 3) Models trained on malicious data to aid cybercrime, such as WormGPT, which is designed to write malware and phishing emails; and 4) AI-augmented malware and infrastructure, including systems capable of calling up to 120 people at once for scam operations.

Advertisements for AI tools on underground forums and platforms surged from fewer than 50 per month in late 2025 to more than 1,400 per month by February 2026. This increase highlights the rapid commercialization of AI tools by cybercriminals.