22-year-old detained for developing WormGPT malicious AI model
A 22-year-old in Portugal was detained for developing and selling WormGPT, a malicious large language model without content safeguards designed to help criminals with limited technical knowledge create malware, conduct phishing attacks, and execute financial fraud. The model was commercialised on darknet forums from early 2023, and authorities seized the system's infrastructure during an investigation.
What happened
A 22-year-old was detained by Polícia Judiciária on 12 February 2025 in connection with developing and commercialising WormGPT, a large language model designed for malicious purposes.
WormGPT was launched in early 2023 as a model analogous to ChatGPT but without the original's limitations and with additional functionality. It was sold in darknet hacking forums and enabled users to create phishing scripts, develop malware, and conduct financial fraud with minimal technical knowledge.
Reported impact
WormGPT could be acquired in cybercriminal forums and allowed criminals with limited technical expertise to automate malicious activities. The model could be used to create elaborate financial frauds, cyberattacks, corporate espionage, and targeted disinformation campaigns.
During Operation 'Neutral Kill Switch', the Unidade Nacional de Cibercrime e Criminalidade Tecnológica seized the entire computational infrastructure of the system, documents and other information relevant to the investigation.
Classification
Sources and evidence
This record was researched and written by the Index, based on the following original reporting.