It was only a matter of time before the famous ChatGPT was emulated for malicious purposes, and one such tool now on the market is known as WormGPT. Should we be worried? Here’s everything you need to know.
When ChatGPT was made available to the public on November 30, 2002, the AI chatbot took the world by storm.
The software was developed by OpenAI, an artificial intelligence and research company. ChatGPT is a language processing tool that can answer questions and provide information based on a data set collected from multiple sources, including online books and web pages, which has become an invaluable tool for information gathering, analysis, and writing for millions of users around the world.
While some experts believe that this technology could prove to be “disruptive” to the Internet, others believe that ChatGPT demonstrates “safe inaccuracy” in its responses. Many students have been caught plagiarizing courses through the tool, and unless the datasets are verified, AI chatbots like ChatGPT could become unwitting tools for spreading misinformation and propaganda.
In fact, the US Federal Trade Commission (FTC) is investigating Open AI, specifically over its handling of personal information and the data used to create its language model.
Beyond data protection concerns, however, whenever a new technological innovation is created that is useful to humans, there is also a parallel path of abuse of the technology. It was only a matter of time before the chatboat was emulated for malicious purposes, and one such tool is now on the market, known as WormGPT.
What is WormGPT?
On July 13, researchers at cybersecurity firm SlashNext published a blog post revealing the discovery of WormGPT, a tool promoted for sale on a hacker forum.
According to the forum user, the WormGPT project aims to be a blackhat “alternative” to ChatGPT, “a tool that allows you to do all sorts of illegal stuff and easily sell it online in the future.”
SlashNext has gained access to the tool, which has been described as an AI module based on the GPTJ language model. WormGPT has allegedly been trained with data sources that include malware-related information, but the specific datasets remain known only to the author of WormGPT.
It could be possible for WormGPT to generate malicious code, for example, or convincing phishing emails.
What is WormGPT used for?
WormGTP is described as “similar to ChatGPT but has no ethical limitations or boundaries.”
ChatGPT has a number of rules to try to prevent users from abusing the chatbot in unethical ways. This includes refusing to complete criminal and malware-related tasks. However, users are constantly finding ways around these limitations.
The researchers were able to use WormGPT to “generate an email intended to pressure an unsuspecting account manager into paying a fraudulent invoice.” The team was surprised by how well the language model handled the task, calling the result “remarkably persuasive [and] also strategically clever.”
While the researchers didn’t say they’d tried the malware-writing service, it’s plausible that the AI bot could do so, given that ChatGPT has no limits.
A Telegram channel reportedly launched to promote the tool, posts seen by ZDNET indicate that the developer is creating a subscription model for access, ranging from $60 to $700. One member of the channel, “darkstux,” says there are already over 1,500 users of WormGPT.
Our WormGPT tool in action Buy/Questions – https://t.co/XXv2dm4UCC#WormGPT #AI #CyberSecurity #ChatGPT #OpenAI #WormAI #Worm #ArtificialIntelligence #Malware pic.twitter.com/toBb8NfU8D — WormGPT (@wormgpt) July 17, 2023
Is WormGPT the same as ChatGPT?
No. ChatGPT was developed by OpenAI, a legitimate and respected organization. WormGMT is not their creation and is an example of how cybercriminals can take inspiration from advanced AI chatbots to develop their own malicious tools.
Will there be more tools like WormGPT in the future?
Even in the hands of novices and the typical scammer, natural language models could transform easily avoidable phishing and Business Email Compromise (BEC) scams into sophisticated operations that are more likely to succeed. There is no doubt that where money is to be made, cybercriminals will pursue any initiative, and WormGPT is just the beginning of a new range of cybercriminal tools set to be traded on black markets.
It is also unlikely that WormGPT is unique in the dark web world.
What are regulators saying about AI tool abuse?
Europol : Europol said in its 2023 report, “The Impact of Large Language Models (LLMs) on Law Enforcement,” it expects “it will be critical to monitor […] development, as Dark LLMs (Large Language Models) trained to facilitate malicious output may become a key criminal business model of the future. This poses a new challenge for law enforcement, whereby it will become easier than ever for bad actors to perpetrate criminal activity without the necessary prior knowledge.”
Federal Trade Commission : The FTC is investigating ChatGPT creator OpenAI over data usage policies and inaccuracy.
UK National Crime Agency (NCA): The NCA warns that AI could lead to an explosion of risks and abuse for young people.
UK Information Commissioner’s Office (ICO): The ICO has reminded organisations that their AI tools are still bound by existing data protection laws.
Can ChatGPT be used for illegal purposes?
Screenshot by the author
With the right prompts, many chatbot models can be persuaded to perform certain actions and tasks, not without hidden tactics.
ChatGPT, for example, can draft professional emails, cover letters, resumes, purchase orders, and more. This alone can remove some of the most common indicators of a phishing email: spelling mistakes, grammatical errors, and problems with a second language. This alone could cause problems for companies trying to train their staff to recognize suspicious emails.
SlashNext researchers say that “cybercriminals can use the technology to automate the creation of highly convincing fake emails, personalized to the recipient, thereby increasing the chances of a successful phishing attack.”
How much does ChatGPT cost?
ChatGPT is free. The tool can be used to answer general questions, write content and code, or generate prompts for everything from creative stories to marketing projects.
There is a subscription option, ChatGPT Plus, that users can sign up for. The subscription costs $20 per month and provides users with access to ChatGPT during peak hours and otherwise, faster response times, and priority access to improvements and fixes.
It was only a matter of time before the famous ChatGPT was emulated for malicious purposes, and one such tool now on the market is known as WormGPT. Should we be worried? Here’s everything you need to know.
When ChatGPT was made available to the public on November 30, 2002, the AI chatbot took the world by storm.
The software was developed by OpenAI, an artificial intelligence and research company. ChatGPT is a language processing tool that can answer questions and provide information based on a data set collected from multiple sources, including online books and web pages, which has become an invaluable tool for information gathering, analysis, and writing for millions of users around the world.
While some experts believe that this technology could prove to be “disruptive” to the Internet, others believe that ChatGPT demonstrates “safe inaccuracy” in its responses. Many students have been caught plagiarizing courses through the tool, and unless the datasets are verified, AI chatbots like ChatGPT could become unwitting tools for spreading misinformation and propaganda.
In fact, the US Federal Trade Commission (FTC) is investigating Open AI, specifically over its handling of personal information and the data used to create its language model.
Beyond data protection concerns, however, whenever a new technological innovation is created that is useful to humans, there is also a parallel path of abuse of the technology. It was only a matter of time before the chatboat was emulated for malicious purposes, and one such tool is now on the market, known as WormGPT.
What is WormGPT?
On July 13, researchers at cybersecurity firm SlashNext published a blog post revealing the discovery of WormGPT, a tool promoted for sale on a hacker forum.
According to the forum user, the WormGPT project aims to be a blackhat “alternative” to ChatGPT, “a tool that allows you to do all sorts of illegal stuff and easily sell it online in the future.”
SlashNext has gained access to the tool, which has been described as an AI module based on the GPTJ language model. WormGPT has allegedly been trained with data sources that include malware-related information, but the specific datasets remain known only to the author of WormGPT.
It could be possible for WormGPT to generate malicious code, for example, or convincing phishing emails.
What is WormGPT used for?
WormGTP is described as “similar to ChatGPT but has no ethical limitations or boundaries.”
ChatGPT has a number of rules to try to prevent users from abusing the chatbot in unethical ways. This includes refusing to complete criminal and malware-related tasks. However, users are constantly finding ways around these limitations.
The researchers were able to use WormGPT to “generate an email intended to pressure an unsuspecting account manager into paying a fraudulent invoice.” The team was surprised by how well the language model handled the task, calling the result “remarkably persuasive [and] also strategically clever.”
While the researchers didn’t say they’d tried the malware-writing service, it’s plausible that the AI bot could do so, given that ChatGPT has no limits.
A Telegram channel reportedly launched to promote the tool, posts seen by ZDNET indicate that the developer is creating a subscription model for access, ranging from $60 to $700. One member of the channel, “darkstux,” says there are already over 1,500 users of WormGPT.
Our WormGPT tool in action Buy/Questions – https://t.co/XXv2dm4UCC#WormGPT #AI #CyberSecurity #ChatGPT #OpenAI #WormAI #Worm #ArtificialIntelligence #Malware pic.twitter.com/toBb8NfU8D — WormGPT (@wormgpt) July 17, 2023
Is WormGPT the same as ChatGPT?
No. ChatGPT was developed by OpenAI, a legitimate and respected organization. WormGMT is not their creation and is an example of how cybercriminals can take inspiration from advanced AI chatbots to develop their own malicious tools.
Will there be more tools like WormGPT in the future?
Even in the hands of novices and the typical scammer, natural language models could transform easily avoidable phishing and Business Email Compromise (BEC) scams into sophisticated operations that are more likely to succeed. There is no doubt that where money is to be made, cybercriminals will pursue any initiative, and WormGPT is just the beginning of a new range of cybercriminal tools set to be traded on black markets.
It is also unlikely that WormGPT is unique in the dark web world.
What are regulators saying about AI tool abuse?
Europol : Europol said in its 2023 report, “The Impact of Large Language Models (LLMs) on Law Enforcement,” it expects “it will be critical to monitor […] development, as Dark LLMs (Large Language Models) trained to facilitate malicious output may become a key criminal business model of the future. This poses a new challenge for law enforcement, whereby it will become easier than ever for bad actors to perpetrate criminal activity without the necessary prior knowledge.”
Federal Trade Commission : The FTC is investigating ChatGPT creator OpenAI over data usage policies and inaccuracy.
UK National Crime Agency (NCA): The NCA warns that AI could lead to an explosion of risks and abuse for young people.
UK Information Commissioner’s Office (ICO): The ICO has reminded organisations that their AI tools are still bound by existing data protection laws.
Can ChatGPT be used for illegal purposes?
Screenshot by the author
With the right prompts, many chatbot models can be persuaded to perform certain actions and tasks, not without hidden tactics.
ChatGPT, for example, can draft professional emails, cover letters, resumes, purchase orders, and more. This alone can remove some of the most common indicators of a phishing email: spelling mistakes, grammatical errors, and problems with a second language. This alone could cause problems for companies trying to train their staff to recognize suspicious emails.
SlashNext researchers say that “cybercriminals can use the technology to automate the creation of highly convincing fake emails, personalized to the recipient, thereby increasing the chances of a successful phishing attack.”
How much does ChatGPT cost?
ChatGPT is free. The tool can be used to answer general questions, write content and code, or generate prompts for everything from creative stories to marketing projects.
There is a subscription option, ChatGPT Plus, that users can sign up for. The subscription costs $20 per month and provides users with access to ChatGPT during peak hours and otherwise, faster response times, and priority access to improvements and fixes.