[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$freOFvkU4VOTZzaJKRihJcXJ5IRcYribJcStJ1mOIbXc":3,"$fdfgXDEO5ZoxmL9IY7R41NP8MrKpeZwfREGFL9gGpyQ4":24},{"article":4},{"slug":5,"title":6,"subtitle":7,"summary":8,"tags":9,"body_md":15,"hero_image_url":16,"structured":17,"story_type":20,"created_at":21,"updated_at":22,"published_at":23},"wormgpt-v5-2-ultra-the-agentic-ai-crime-ecosystem-that-runs-50k-hackers","WormGPT v5.2 Ultra: The Agentic AI Crime Ecosystem That Runs 50K+ Hackers","ThreatMon's Aug 7 analysis confirms WormGPT has evolved into a six-model agentic AI suite with 50K+ active engineers, deep reasoning core, and zero content filters.","WormGPT, the ChatGPT alternative built for blackhat work, has shipped v5.2 Ultra with a deep reasoning core, six high-performance models, and 50K+ active engineers running it for phishing, BEC, and malware generation.",[10,11,12,13,14],"WormGPT","agentic-AI","cybercrime","GPT-J","BEC-phishing","# WormGPT v5.2 Ultra: The Agentic AI Crime Ecosystem That Runs 50K+ Hackers\n\n*ThreatMon's Aug 7 analysis confirms WormGPT has evolved into a six-model agentic AI suite with 50K+ active engineers, deep reasoning core, and zero content filters.*\n\n**Tags:** `WormGPT` `agentic-AI` `cybercrime` `GPT-J` `BEC-phishing`\n\n> WormGPT, the ChatGPT alternative built for blackhat work, has shipped v5.2 Ultra with a deep reasoning core, six high-performance models, and 50K+ active engineers running it for phishing, BEC, and malware generation.\n\n---\n\n## WormGPT v5.2 Ultra: The agentic AI crime engine\n\nWormGPT has shipped v5.2 Ultra, the flagship model in its six-model suite, built around a deep reasoning core with zero content filters. The new release sits alongside v5.1 Uncensored, Coder v5.1, v5.0 Ultra, v4.1, and v4 Classic, giving users a full stack from ultra-low latency streaming to the main event.\n\nThe platform now claims 50,000+ active engineers, 99.9% uptime, and 100% uncensored output across the board. Pricing starts at $50\u002Fmonth for the 1-month plan, which includes unlimited generations, unrestricted v5.2 Ultra access, live web search, file analysis, and four daily workspace uploads. The $260 lifetime VIP tier adds faster responses, unlimited file uploads, agent mode, VSCode integration, and full source code access. Payments go through USDT or 100+ tokens via automated crypto checkout, with manual Telegram orders as a fallback.\n\n## How the agentic AI works\n\nWormGPT is built on GPT-J, the open-source LLM from 2021, and trained specifically on malware-heavy data. The v5.2 Ultra flagship adds a deep reasoning core that handles thinking, JSON mode, and multi-turn logic in a single pass.\n\nThe $50\u002Fmonth tier gives you unlimited generations, unrestricted v5.2 Ultra access, live web search, file analysis, and four daily workspace uploads. The $260 lifetime VIP tier adds Agent Mode, VSCode integration, and full source code access on top of faster responses and unlimited file uploads.\n\n## The BEC test that made it famous\n\nSlashNext researcher Daniel Kelley put WormGPT to the test that made it famous: a prompt asking the model to write a business email compromise (BEC) email designed to pressure an unsuspecting account manager into paying a fraudulent invoice.\n\nThe output was, in Kelley’s words, “remarkably persuasive” and “strategically cunning.” The generated email used professional language, included a wire-transfer request, and came back with zero spelling or grammar errors — the kind of typos that usually give away a phishing email. No content filter, no refusal, no `I'm an AI and can't do that`.\n\nBeyond BEC, WormGPT can write Python malware, craft jailbreak payloads, and handle smishing and blackmail prompts. It’s the same model that answers the requests ChatGPT would refuse — no guardrails, no topic blocks, no artificial content filtering. Ask it to generate a reverse shell or a ransom note and it just does it.\n\n## The full model lineup\n\nThe six-model lineup spans from a lightweight baseline to the deep-reasoning flagship. v5.2 Ultra is the main event: a deep reasoning core with zero content filters, handling thinking, JSON mode, and multi-turn logic in a single pass. It’s the model you point at a pentest or a full-stack app and expect raw output.\n\nv5.1 Uncensored is the workhorse for complex multi-turn logic and JSON mode, with function calling for tool execution. Coder v5.1 is the specialized code model: AST parsing, refactoring, vulnerability scanning, and full-stack debugging. v5.0 Ultra is the high-throughput streamer at 78 tok\u002Fs, built for real-time streaming, high-volume calls, and agent loops.\n\nv4.1 is the unfiltered creative model with custom persona control and long-form writing. v4 Classic is the lightweight baseline for quick text extraction and batch requests. All six ship on every plan, so the $50\u002Fmonth tier gets the full stack from v4 Classic up to v5.2 Ultra.\n\n## Key points\n\n- WormGPT v5.2 Ultra is the flagship model with a deep reasoning core and zero content filters, built on GPT-J (2021) and trained on malware-heavy data.\n- The platform now ships six models: v5.2 Ultra (flagship), v5.1 Uncensored, Coder v5.1, v5.0 Ultra (78 tok\u002Fs), v4.1, and v4 Classic.\n- 50K+ active engineers are running it globally with 99.9% uptime; plans range from $50\u002Fmonth to $260 lifetime VIP with full source code access.\n- WormGPT handles BEC\u002Fphishing, malware generation, jailbreaks, and smishing — no ethical guardrails, no topic blocks, no artificial content filtering.\n- ThreatMon's Aug 7, 2026 analysis confirms the full agentic AI crime ecosystem, including agent mode, VSCode integration, and live web search with file analysis.\n\n## Further reading & sources\n\n- [WormGPT and FraudGPT: The dark side of generative AI](https:\u002F\u002Fwww.siliconrepublic.com\u002Fenterprise\u002Fwormgpt-fraudgpt-chatgpt-generative-ai-cyberattacks)\n- [Beware! ChatGPT doppelganger WormGPT is helping cybercriminals launch online attacks - Technology News | The Financial Express](https:\u002F\u002Fwww.financialexpress.com\u002Flife\u002Ftechnology-beware-chatgpt-doppelganger-wormgpt-is-helping-cybercriminals-launch-online-attacks-3177862\u002F)\n- [WormGPT: AI tool designed to help cybercriminals will let hackers develop attacks on large scale, experts warn - Yahoo News UK](https:\u002F\u002Fuk.news.yahoo.com\u002Fwormgpt-ai-tool-designed-help-102800469.html)\n- [WormGPT, WolfGPT and FraudGPT - how to spot scams created by ChatGPT’s ‘evil cousins’](https:\u002F\u002Fuk.finance.yahoo.com\u002Fnews\u002Fwormgpt-wolfgpt-and-fraudgpt---how-to-spot-scams-created-by-chatgpts-evil-cousins-152632796.html)\n- [WormGPT Is a ChatGPT Alternative With 'No Ethical Boundaries or Limitations'](https:\u002F\u002Fuk.pcmag.com\u002Fai\u002F147755\u002Fwormgpt-is-a-chatgpt-alternative-with-no-ethical-boundaries-or-limitations?_hsenc=p2ANqtz--4SKxYZdn-x4qeSOpoCvtQtkDGvnZfsqMIrdcPOktJeUbmctKY0nfBUasXshVuV1C6_D1c1ehHDBS4MixmvHtSRpkjDQ)\n- [WORMGPT](https:\u002F\u002Fwww.wormgpt.co\u002F)\n- [WormGPT](https:\u002F\u002Fwww.wormgpt.net\u002F)\n- [WormGPT Is a ChatGPT Alternative With 'No Ethical Boundaries or Limitations'](https:\u002F\u002Fuk.pcmag.com\u002Fai\u002F147755\u002Fwormgpt-is-a-chatgpt-alternative-with-no-ethical-boundaries-or-limitations?_hsenc=p2ANqtz-9sUmYil0sgYAyYIGiSo1ngyqmn_kDgEMD0rETg2pnGO1o-eIjOz-og7P2APha1sHzSPYfM)\n- [What Is WormGPT? | Malicious AI Model Explained](https:\u002F\u002Fwww.rapid7.com\u002Ffundamentals\u002Fwhat-is-wormgpt\u002F)\n- [WormGPT · Free AI Chatbot](https:\u002F\u002Fminiapps.ai\u002FWormgp-official)\n- [About WormGPT — Uncensored AI Agent for Security Research](https:\u002F\u002Fwormgpt.chat\u002Fabout)\n- [GitHub - hexsecteam\u002Fworm-gpt: WormGPT CLI is a sleek command-line interface (CLI) for interacting with LLMs via OpenRouter API. It supports multiple models, automatic language detection, and customizable settings — all in a terminal-friendly format. · GitHub](https:\u002F\u002Fgithub.com\u002Fhexsecteam\u002FWorm-gpt)","https:\u002F\u002Fapi.precursorintelligence.com\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Fnews-heroes\u002Fwormgpt-v5-2-ultra-the-agentic-ai-crime-ecosystem-that-runs-50k-hackers.png?v=65401b5b8f",{"malware":18},[19],{"name":10},"threat_actor_activity","2026-08-29T07:18:10.379883+00:00","2026-10-16T12:29:05.848606+00:00",null,{"articles":25},[26,39,52,64],{"slug":27,"title":28,"summary":29,"tags":30,"hero_image_url":37,"story_type":20,"created_at":38},"russian-state-actors-exploit-exposed-ip-cameras-to-track-nato-troop-movements-in","Russian State Actors Exploit Exposed IP Cameras to Track NATO Troop Movements in Ukraine","The Netherlands' AIVD and MIVD released a joint advisory warning that Russian state actors are systematically exploiting publicly exposed IP cameras to track NATO troop and supply movements in the ongoing Ukraine war.",[31,32,33,34,35,36],"Russia","IP Camera","NATO","Ukraine","AIVD","MIVD","https:\u002F\u002Fapi.precursorintelligence.com\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Fnews-heroes\u002Frussian-state-actors-exploit-exposed-ip-cameras-to-track-nato-troop-movements-in.png?v=74b95987f5","2026-09-30T07:07:04.966623+00:00",{"slug":40,"title":41,"summary":42,"tags":43,"hero_image_url":50,"story_type":20,"created_at":51},"fancy-bear-ai-enabled-attacks-surge-89-in-crowdstrike-2026-report","Fancy Bear AI-Enabled Attacks Surge 89% in CrowdStrike 2026 Report","CrowdStrike's 2026 Global Threat Report shows Fancy Bear (APT28) AI-enabled adversary activity up 89% year-over-year, eCrime average breakout time at 29 minutes, and GenAI prompt injection confirmed at 90+ organizations.",[44,45,46,47,48,49],"Fancy Bear","APT28","CrowdStrike","LLM malware","GenAI prompt injection","eCrime","https:\u002F\u002Fapi.precursorintelligence.com\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Fnews-heroes\u002Ffancy-bear-ai-enabled-attacks-surge-89-in-crowdstrike-2026-report.png?v=f7ed8c119c","2026-09-29T12:06:38.382267+00:00",{"slug":53,"title":54,"summary":55,"tags":56,"hero_image_url":62,"story_type":20,"created_at":63},"palo-alto-unit-42-405-ai-enabled-malware-samples-show-12-in-production","Palo Alto Unit 42: 405 AI-enabled malware samples show 12 in production","Palo Alto Networks Unit 42 analyzed 405 AI-enabled malware samples and found the space is dominated by PoC and researcher code, with only 12 samples hitting production endpoints across five distinct malware families.",[57,58,59,60,61],"AI malware","FunkSec","Palo Alto Unit 42","ransomware","LLM","https:\u002F\u002Fapi.precursorintelligence.com\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Fnews-heroes\u002Fpalo-alto-unit-42-405-ai-enabled-malware-samples-show-12-in-production.png?v=efb3f6f578","2026-09-26T12:10:59.266452+00:00",{"slug":65,"title":66,"summary":67,"tags":68,"hero_image_url":74,"story_type":20,"created_at":75},"gen-digital-researchers-unveil-wordlistloader-and-synkloader-malware-loaders-for","Gen Digital Researchers Unveil WordlistLoader and SynkLoader Malware Loaders for ClickFix Infostealer Delivery","Gen Digital researchers identified two new malware loaders, WordlistLoader and SynkLoader, that deliver infostealers and phishing credentials through the ClickFix technique and are sold to ransomware affiliates.",[69,70,71,72,73,60],"Gen Digital","ClickFix","WordlistLoader","SynkLoader","infostealer","https:\u002F\u002Fapi.precursorintelligence.com\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Fnews-heroes\u002Fgen-digital-researchers-unveil-wordlistloader-and-synkloader-malware-loaders-for.png?v=ea5de72eef","2026-09-25T12:05:45.613962+00:00"]