The state of the underground AI market: what defenders need to know

tl;dr

Criminal AI chatbots such as WormGPT and Kriminal are mostly mainstream or freely downloadable (“open-weights”) models behind a jailbreak prompt, and they change little for defenders. The bigger trade is access to the models your teams already use: stolen keys and accounts, and discount relays that resell that access. Two things need action: AI keys and sessions on developer machines, which end up paying for other people’s work, and staff or vendors who send company prompts through a relay whose operator can read them.

• In Halcyon’s count of underground AI posts, jailbroken and stolen AI services were the largest category, with 1,026 posts against 888 for criminal chatbots. Sellers offer access to mainstream models more often than criminal ones.
• GitGuardian counted 1,275,105 AI-service secrets leaked on public GitHub in 2025, up 81% on 2024. Any that still work give free access to whoever finds them, billed to the key’s owner.
• A stolen Gemini key ran up $82,314 in 48 hours for one startup, The Register reported. On pay-as-you-go accounts, the key owner pays for everything run on the key.
• An exposed page for one relay, Poison Claude, reported 881 users, and Okta notes that a relay like it can see every prompt its users send.

The market at a glance

The underground AI market sells four kinds of product. The figure numbers them 1 to 4 by risk to your organization: how likely each is to reach you, and what it costs when it does. That ranking is our assessment from the evidence in this post. The first two, in peach, are high risk. Cream marks low to medium risk, and sage marks low risk. The sections below take them in reverse order, from criminal chatbots up to stolen access.

Ranked from highest to lowest risk. One, stolen AI access, high risk: stolen keys, accounts and session cookies; a stolen key bills its owner for everything run on it. Two, discount AI relays, high risk: cheap access to real models through someone else's server; your staff, contractors or vendors may be customers, and the operator can read their prompts and code. Three, AI malware and fraud tools, low to medium risk: attack kits and deepfake identity kits, mostly advertised and aimed at threats existing controls are built for. Four, criminal AI chatbots, low risk: jailbroken mainstream models sold as uncensored AI, whose output is ordinary phishing and commodity malware.

1. 1 · High risk Stolen AI access Stolen keys, accounts and session cookies. A stolen key bills its owner for everything run on it.
2. 2 · High risk Discount AI relays Cheap access to real models through someone else's server. Your staff, contractors or vendors may be customers, and the operator can read their prompts and code.
3. 3 · Low to medium risk AI malware and fraud tools Attack kits and deepfake identity kits. Mostly advertised, and aimed at threats your controls are built for.
4. 4 · Low risk Criminal AI chatbots Jailbroken mainstream models sold as "uncensored AI". Their output is ordinary phishing and commodity malware.

Criminal AI chatbots

The chatbots sold to criminals since 2023, marketed as “dark AI” or “uncensored AI”, share one design. A seller takes a mainstream or open-weights model, adds a system prompt that talks it out of its safety training, and sells subscriptions. Trend Micro’s review of the market in January 2026 found jailbreak-as-a-service dominant, and no criminal models built and run on criminal infrastructure.

The six best-reported examples, and what each one turns out to be:

Chatbot	What it really is	Reported by
Omega AI	A small fraud-tool shop with a jailbroken chatbot attached; its own model list includes “Claude (Jailbreak)” and a jailbroken GPT	Signals Corps, from its public app and Telegram, October 2026
WormGPT (v4)	A revived 2023 brand running on jailbroken Grok and Mixtral; output is basic scripts and phishing	Cato CTRL, Unit 42
Xanthorox	Marketed as its own model; asked directly, it named its base as Google’s Gemini Pro	TrendAI
KawaiiGPT	Free “waifu” branding over DeepSeek, Gemini and Kimi-K2; output rated rudimentary	Trend Micro, Unit 42
Kriminal	Sold as “not a jailbreak”, actually Grok reached through a routing service	ThreatDown
FraudGPT	Sold since 2023; often an outright scam, taking crypto for a login that never works	Cisco Talos

Asked to drop its persona, one of them names the model underneath:

These are a fragile, declining product: each depends on a provider account that can be banned, and Bitsight, tracking 16 forums, saw mentions of them fall 8.7% from February to August 2026 while talk of AI agents, prompt injection and MCP (the standard way agents connect to outside tools and data) rose 67%.

AI malware and fraud tools

Attack and fraud tools sit one step up, and most of them are also more advertised than used. Halcyon told Axios it found no criminals selling AI systems that run whole attacks on their own with real success. MONST3R-AI, in the stolen access section below, claims to, but its results are unverified. This table lists the tools with the clearest reporting and whether each has been seen in use.

Tool	Reported by	What it does	Seen in real attacks
PROMPTSTEAL	Google, Nov 2025	A data miner that asks a model to write its commands, linked to APT28	Yes
Prompt injection kits	Proofpoint, Jul 2026	Build hidden instructions meant to manipulate AI assistants that read email, documents and web pages	Tested, not used at scale
Deepfake identity kits	Halcyon, 2026	Synthetic faces and videos sold to pass identity checks	Advertised

These are the same threats your phishing, identity verification and malware controls are built for.

Discount AI relays

Relays are where the risk starts to involve your own staff. A relay resells access to a real model at a fraction of the list price. The customer gets an API key and points their tools at the operator’s server by changing one setting, the base URL. The operator forwards each request to a pool of upstream accounts funded by stolen keys, free sign-up credits, shared subscriptions or stolen cards. Every prompt, file and response passes through the operator’s server.

Poison Claude

Okta reported in August 2026 on Poison Claude, one of several such services advertised on underground forums and messaging platforms. It sold Claude access for a small fraction of the official price and filled its pool with free cloud sign-up credits, probably from fraudulent registrations. An exposed page reported 881 users. Customers set environment variables so Claude Code sends its requests to Poison Claude’s server, and Okta notes that in this setup the operator can see every prompt. Okta found a second service, Ecomagent, selling Claude and GPT Codex access to under 1,000 users from what it says are startup credits.

Chinese relay networks

Much of the relay market serves users in China. The Cloud Security Alliance found one relay offering $3,333 of Anthropic credit for about $59, under 2% of the official price. Team Cymru reported in September 2026 that its first scan found 10,867 relay servers, a count that has since passed 80,000. Over eight days in late August, 17 relays sending traffic to Anthropic uploaded what Team Cymru estimates could be 16 to 23 billion input tokens, so a few relays move a large volume of other people’s prompts.

Some relays sell what passes through them: Anthropic said in September 2026 that some relays saved users’ conversations to sell them to AI labs. A relay can also swap in a weaker model: in one study, a relay sold as “Gemini-2.5” scored 37% on a medical benchmark, against 84% for the real model, so work sent through it may come back worse.

Outlook for discount AI relays

Relays can expose company code without any breach, through staff, contractors or vendors who choose them to save money. We found no public count of how many companies this affects. The relay software is open source, and developers use it legitimately to manage several model providers behind one interface. The risk depends on who runs the server and what they keep. The buyer does not have to be a criminal. It can be a developer paying for a coding agent personally, a contractor cutting costs, or a vendor whose product calls a relay to protect its margin. A coding agent sends the contents of the files it reads to the model with its requests, so a relay can collect source code, configuration and any secrets in them.

Stolen AI access

The access that relays and attack tools run on has to come from somewhere, and access to real models, stolen or jailbroken, is the most common product on offer. In Halcyon’s count, jailbroken and stolen AI services made up 1,026 posts, the largest category. Google’s threat intelligence group reported in September 2026 that average underground prices for AI accounts more than doubled during the year, with demand strongest for stolen Claude and Gemini credentials and coding-agent accounts such as Cursor Pro. For defenders, that made a developer’s AI account a more valuable thing to steal this year.

Where the access comes from

Stolen AI access comes from five places:

• Leaked keys. GitGuardian counted 1,275,105 AI-service secrets on public GitHub in 2025, up 81% on 2024, including 24,008 in MCP configuration files, which many secret scans skip.
• Infostealers. Google reported that in May, ACRSTEALER operators began targeting configuration files of the coding assistants Cline and Continue, which can hold API keys in plain text. KELA counted more than 49,700 AI platform session cookies for sale, which let a buyer skip the password and MFA.
• Hacked web servers. Bissa Scanner stole .env files from more than 900 compromised organizations, and AI provider keys were the largest category it collected.
• Exposed model servers. About 175,000 Ollama servers answer on the internet, and Ollama has no authentication by default.
• Breached platforms. In October 2026, an attacker in Railway’s build infrastructure searched customers’ environment variables for AI keys, which Railway says were wanted for model distillation (training a cheaper model to copy a costly one).

MONST3R-AI

MONST3R-AI shows where stolen keys end up. Bitsight found it sold on a restricted forum as an “autonomous penetration testing platform”. The seller hosts no model. Buyers bring stolen OpenAI, Anthropic or Google keys, set a budget and point the tool at their targets. When it scans a target with your key, your company pays for the model calls behind the attack. The seller’s claims about its results are unverified.

What it costs victims

This table lists cases where researchers traced how stolen access was resold or used, and what it cost where known.

Case	Reported by	What happened
A relay reselling stolen keys	Sysdig, Feb 2025	Sold access running on stolen OpenAI, AWS, Azure and Google keys. About $49,596 of usage in four and a half days, billed to the key owners
Operation Bizarre Bazaar	Pillar Security, Jan 2026	A marketplace that resold access to hijacked AI servers across more than 30 providers at 40% to 60% off, at the server owners’ expense
A startup’s Gemini key	The Register, Mar 2026	$82,314 in 48 hours, against a normal bill of about $180 a month

Outlook for stolen AI access

We expect key theft to keep growing. Pay-as-you-go cloud AI accounts often have no hard spending cap by default, and the Railway breach suggests attackers are starting to take keys in bulk from the platforms that store them.

What to do

The controls follow how access leaks out: find your keys before someone else does, cap what a stolen key can cost, keep your own model servers private, and know where your agents send prompts.

1. Scan for AI keys. Add AI provider key formats to secret scanning, and include MCP and agent configuration files. Treat a leaked AI key like a leaked cloud credential: rotate it the same day.
2. Protect developer machines. Coding-agent configuration files can hold keys in plain text. When an infostealer hits a developer’s device, rotate their AI keys and end their AI sessions along with their passwords.
3. Cap the bill. Set hourly spending alerts on every AI account and turn on invocation logging (CloudTrail for Bedrock, Azure Monitor for Azure OpenAI, Cloud Audit Logs for Vertex AI), and prefer short-lived credentials to static keys, as the Cloud Security Alliance recommends. Add hard spending limits where the provider supports them.
4. Keep model servers off the internet. Put Ollama behind authentication on an internal network, and run version 0.17.1 or later. That release fixes CVE-2026-7482, which the Cloud Security Alliance notes can leak API keys, environment variables and conversation data.

5. Check where agents send prompts. A relay needs a base URL override. Claude Code reads ANTHROPIC_BASE_URL from the environment or from the env block of ~/.claude/settings.json, and repositories can also set it in .claude/settings.json or .claude/settings.local.json. OpenAI’s SDKs read OPENAI_BASE_URL, and Codex takes a base_url for custom providers in ~/.codex/config.toml. If the host is not the provider or your own gateway, ask the device owner why it is set. These commands show overrides in the common places, and the last one covers a repository when run from its root:

   env | grep -E '^(ANTHROPIC|OPENAI)_BASE_URL='
   grep -nE 'ANTHROPIC_BASE_URL|OPENAI_BASE_URL|base_url' \
     ~/.claude/settings.json ~/.codex/config.toml \
     ~/.zshrc ~/.bashrc ~/.profile 2>/dev/null
   grep -nE 'ANTHROPIC_BASE_URL' \
     .claude/settings.json .claude/settings.local.json 2>/dev/null
   

   We ran all three on one Linux test machine, with overrides planted in the environment, ~/.claude/settings.json, ~/.codex/config.toml and a repository’s .claude/settings.local.json, and they found all four. They read only the current user’s environment and the files listed, so they miss project .env files and Windows machines. Try them on one machine first, and check with your privacy team before collecting results across devices. In proxy logs, look for Anthropic- or OpenAI-style API paths, such as /v1/messages or /v1/chat/completions, going to domains that belong to neither.

6. Ask vendors which model endpoint they call and whose account pays for it. The Cloud Security Alliance suggests asking whenever a vendor’s AI pricing looks unusually cheap.
7. Make the approved tool the easy choice. Staff who can’t get a paid seat will find a cheaper one.

Summary

The underground AI market matters to defenders less for its chatbots than for the access it resells: stolen keys billed to their owners, and relays that can read your teams’ prompts. Both reach into companies through developer laptops and vendors.

Treat AI keys and sessions like cloud credentials, put a ceiling on what any one of them can cost, and find out which endpoints your agents and vendors send prompts to. Runtime, a Signals Corps Control Plane module, evaluates agent network activity as it happens, so you can warn on or block calls to model endpoints you haven’t approved.