The proliferation and evolution of AI-powered hacking tools – from dark web distribution to autonomous attacks

This report describes the rapid proliferation of AI-enabled hacking tools—from dark web SaaS to open-source models run locally—and documents real-world impacts including the WormGPT user database leak (~19,000 records), the Bissa Scanner campaign that exploited CVE-2025-55182 leading to ~900 compromises and >65,000 credential thefts, and AI-embedded malware (e.g., Promptflux, Promptspy) and nation-state-linked APT use of AI to automate vulnerability analysis and exploitation; the report warns defenders face a speed and cost disadvantage without improved AI governance, MFA, and supply-chain/infrastructure security reviews.