The Evolution of Dark AI: From Manual Forums to Autonomous Agents

In brief — The source explores how criminal hacking transitioned from manual dark web operations to artificial intelligence assisted workflows and autonomous campaigns. [00:42:36]

The dark web is no longer just a hidden destination for human-operated forums, but a continuous automated system. [07:18:13] As malicious software begins querying language models during execution, artificial intelligence has shifted from a mere product to the operational core of cyberattacks. [02:08:35]

The Manual Era of the Dark Web

The dark web, a hidden part of the internet reached through special software, did not disappear but rather evolved into a system that keeps running. [07:12:42] In the past, it was a destination people visited, using forums to talk, markets to buy, and trading stolen credentials. [07:18:13] Every step of an attack relied on a human being. [00:42:36] Without a central search engine, the operator acted as the search engine, connecting different stages manually. [01:12:44] Copy and paste served as the primary integration layer between tools. [01:31:20]

Unrestricted AI as a Product

Figure 1: Criminal AI tools like WormGPT were layered architectures — a brand and interface built on top of someone else's underlying model.

By 2023, unrestricted artificial intelligence was sold as a product for criminals. [01:39:30] Tools like Worm GPT and Fraud GPT emerged, which security researchers noted were marketed for illegal activities and lacked safety guardrails. [01:44:19] These were not proof of unique foundation models, which are large artificial intelligence systems trained from scratch. Instead, they operated as layered architectures. [01:53:39] Underneath, they consisted of three layers: a brand on top, a user interface to log into, and a model or an application programming interface connecting to someone else's model below. An application programming interface, or API, is a software bridge that lets one program call a remote model. According to researchers, Worm GPT was actually built on an open source language model developed in 2021.

Figure 2: AI acts as a triage layer in the attack pipeline, collapsing tens of thousands of noisy records into a manageable queue for the human operator.

AI Entering the Workflow

Rather than just being a standalone product, artificial intelligence started entering the cybercrime workflow to process large datasets. [02:08:35] In a typical six-step attack pipeline, a model can read through a massive dataset, such as an illustrative batch of 50,000 stolen records, and score every line. [04:12:00]

Figure 3: The role of AI in cybercrime shifted rapidly — from a packaged product to a workflow tool to fully autonomous execution in just three years.

Most of the data is noise, which falls away, leaving a manageable fraction like 317 items worth looking at. [02:34:03] The model does not make final decisions; it simply puts the queue in order, leaving a person to review the remaining targets. [02:56:48]

Models Connecting Pipeline Steps

Attackers maintained their operations through both hosted models and open-weight models, which are systems whose parameters are published so they can run locally. [03:39:10] Both routes remain active, providing threat actors with more local control. [03:42:12] By 2025, models had entered data, code, and malicious software known as malware. [04:24:19] A structural shift occurred by 2026, as models began connecting the steps of the attack. [04:32:13]

The new development was malware querying a language model to generate commands dynamically during runtime, the exact moment the program executes. [05:23:04] Google first observed this behavior in the field, marking a departure from static instructions. [05:13:30]

One experimental malware family known as Prompt Flux rewrites its own source code during execution. [05:42:36] This repeated regeneration can alter the static fingerprint, which is the signature used to identify a specific piece of malware. [06:00:03]

The Shift to Autonomous Agents

By September 2026, Google documented a move from simple prompting to full autonomy. [06:42:04] An observed campaign using an autonomous multi-agent framework completed a mass credential harvesting operation in under six hours after initial compromise. [06:49:50] The artificial intelligence managed vulnerability scanning and execution without continuous human oversight. Despite this speed, human operators still set the overarching campaign objectives, determining the goals that the autonomous loop executes. [06:57:37]

Key points

• The dark web evolved from manual forums into automated systems where executing code queries language models. [07:18:13]
• Early criminal artificial intelligence tools were branded interfaces layered over existing models, not unique creations. [01:53:39]
• Malware now dynamically generates commands at runtime instead of relying solely on remote servers. [05:23:04]

Open questions

• What specific defensive tools are being developed to counter prompt flux and runtime code regeneration? [05:42:36]
• How will organizations adapt to campaigns that execute from start to finish in under six hours? [06:49:50]
• How do hackers uncensor existing artificial intelligence models to bypass safety guardrails? [07:24:28]

Key moments

• [00:01:43] The Manual Era of the Dark Web
• [01:39:30] Unrestricted AI as a Product
• [02:08:35] AI Entering the Workflow
• [04:12:00] Models Connecting Pipeline Steps
• [06:42:04] The Shift to Autonomous Agents

Sources

1. Criminals Have Created Their Own ChatGPT Clones | WIRED
2. There's no reason to panic over WormGPT | TechCrunch
3. GTIG AI Threat Tracker: Advances in Threat Actor Usage of AI Tools | Google Cloud Blog
4. services.google.com
5. Autonomous AI Agents Compromise Thousands of Credentials in Under Six Hours
6. Autonomous AI Agents and the Six