Advertisements for artificial intelligence tools on underground cybercrime platforms have increased sharply, rising from under 50 monthly listings in late 2025 to over 1,400 by February, according to a report from Halcyon's Ransomware Research Center. The study, shared first with Axios, indicates that AI is making specialized hacking capabilities cheaper and easier to acquire, potentially transforming a broader range of criminals into dangerous actors.

Halcyon reviewed data from late 2025 through May, sampling content from dozens of Telegram channels, dark web forums, and specialized markets. Sellers on these platforms offered access to ChatGPT Plus accounts for as little as 10 cents and jailbreak prompts designed to trick models into bypassing safety safeguards for 32 cents. Cynthia Kaiser, head of Halcyon's Ransomware Research Center and former deputy director of FBI Cyber, told Axios that the low cost of conducting these activities should be alarming for organizations.

The report describes a commercialization of cybercrime tools, with sellers modeling software-as-a-service subscription models and online storefronts. Some vendors have moved from traditional dark web forums to easier-to-manage storefronts hosted on Telegram. Kaiser noted that cybercriminals have applied their experience in selling and packaging software quickly to AI models, stating that the shift should not have been shocking given their history of adapting sales strategies.

The research identifies four primary categories of AI tools being sold in these markets:

  • Jailbroken and stolen AI services, including prompts that strip safety guardrails from mainstream models for as little as $10.
  • Identity fraud and phishing tools that facilitate the quick impersonation of real people.
  • Access to models trained on malicious data, such as WormGPT, which is designed to write phishing emails and malware.
  • AI-augmented malware and infrastructure, including systems capable of calling as many as 120 people simultaneously for scam operations.

While the marketplace has expanded significantly since 2023, when hackers had access only to a handful of one-off tools, Kaiser emphasized that AI is currently helping criminals perform discrete elements of existing attacks more cheaply and efficiently. She stated that buyers are not yet finding agents capable of executing entire attacks autonomously with high success rates. Halcyon did not find evidence of criminals selling AI systems capable of running fully autonomous cyberattacks. Regarding AI-enabled malware and infrastructure, researchers observed that the technology largely assists with coding, infrastructure management, and other individual tasks rather than creating and deploying malware on its own.