Yes, a dark web AI exists, but the term covers less than the headlines suggest. One security vendor’s review concluded that WormGPT was the only genuinely criminal-built language model, and that most of its successors are scams or repackaged jailbreaks of mainstream chatbots. The original WormGPT is the clearest example of how this market works. It vanished on August 8, 2023, the day journalist Brian Krebs identified the person behind it. Yet Cato CTRL researchers later found new WormGPT variants built on xAI’s Grok and Mistral AI’s Mixtral, so the name outlived the tool. Dark web AI is best understood as a criminal marketing category, not a separate class of powerful, uncensored technology.
This guide separates the real products from the hype. It starts with what dark web AI is and how it differs from mainstream models, then profiles the named tools (WormGPT, FraudGPT, EvilGPT, WolfGPT, VenomGPT, and TerrorGPT) and traces their timeline from 2023 to 2026. It then covers how criminals use AI in practice, whether using these tools is legal, what AI trained on dark web data can and can’t do, and how defenders use AI to investigate the dark web. The final section explains what all of this means for MSSPs and their clients.
What Is Dark Web AI?
Dark web AI defined: models sold, shared, or built for criminal use
Dark web AI is a label for AI tools marketed on underground forums and channels to help with crime, most often phishing, fraud, and malware assistance. It describes how the tool is sold and who it is sold to, and does not describe a distinct kind of technology. The original example, WormGPT, was built on GPT-J 6B, an open-source model from 2021, and sold by subscription. In practice, these tools are usually a language model wrapped in a criminal sales pitch.
Is there a dark web AI? Separating real products from hype and scams
Yes, a few real products have existed, but the market contains far more marketing than technology. One security vendor’s review concluded that WormGPT was the only real criminal-built LLM, and that most successors are scams or jailbroken ChatGPT wrappers. The same review reported that EvilGPT and WolfGPT were exposed as scams when they returned ChatGPT’s own ethical refusals instead of fulfilling illegal requests. FraudGPT followed the same pattern of loud advertising. It launched on July 25, 2023, promising phishing, malicious code, and hacking tutorials, though its sale threads have since disappeared. A name that appears on a forum or in a headline is therefore weak evidence that a working tool exists.
How AI on the dark web differs from mainstream AI with guardrails
The main difference is that dark web AI tools are sold on the promise of having no safety refusals, while mainstream assistants are built to decline harmful requests. Providers like OpenAI, Google, and Microsoft build in safety measures meant to stop their models from being used to create malware or hate speech. Criminal tools remove or bypass those limits. As a result, threat actors can automate multilingual social engineering lures, and the poor grammar that once gave phishing away is gone. The newer approach skips building anything. Cato CTRL found WormGPT variants that jailbreak Grok and Mixtral to bypass their built-in safety features, which means the underlying model is often mainstream.
Why “uncensored” doesn’t mean “more capable”
An uncensored model is only one that won’t refuse, and its ability comes from the base model underneath, not from the missing guardrails. The original WormGPT ran on a 2021 open-source model, and later tools mostly relied on jailbreaking mainstream models. The main benefit of removing guardrails is convenience. A criminal gets fluent, well-formatted text without having to argue past a refusal. That is still a real risk for phishing and business email compromise, where fluent text is most of the attack, but it is not the same as a system that can independently find vulnerabilities or run intrusions. Treat “uncensored” as a description of policy, and judge capability by the model behind it.
Malicious AI Models on the Dark Web
The malicious AI models sold on the dark web are mostly commercial products built around a small number of tactics: phishing, business email compromise, malware assistance, and scam content. WormGPT is the only one widely described as a genuinely purpose-built model. The rest are best treated as branded copycats, and their claims deserve scrutiny.
WormGPT: what it is, when it appeared, what it was marketed to do
WormGPT is a subscription chatbot marketed to criminals as a blackhat alternative to ChatGPT. It is based on GPT-J, an open-source language model developed in 2021, and its seller advertised it for phishing, business email compromise, and writing malicious code. Security firm SlashNext reported on it in a July 13, 2023 blog post and said prices varied by source, from about €60 to €100 a month to as much as €5,000 for a private setup. Its stated pitch was that it removed the refusals found in mainstream assistants. Its developer shut the original project down in August 2023 after heavy media attention, but the name lived on as a brand for later tools.
FraudGPT: subscription-style marketing to fraudsters
FraudGPT is a dark web AI tool sold by subscription, aimed at phishing, carding, and scam content. Netenrich reported that it had been circulating since at least July 22, 2023, priced at $200 a month, $1,000 for six months, or $1,700 for a year. Its advertised features included writing malicious code, creating phishing pages and hacking tools, and writing scam letters. The pricing was a large part of the pitch, since it made the tool look like a professional product. The language model behind it was never identified. Its sales threads have since disappeared.
EvilGPT, WolfGPT, VenomGPT, and TerrorGPT: the copycat pattern
After WormGPT and FraudGPT drew attention, a run of similarly named tools appeared with almost the same pitch: an unrestricted chatbot for phishing, scam scripts, or code. Evil-GPT surfaced in August 2023 on BreachForums, where the seller promoted it as the best alternative to WormGPT for only $10. WolfGPT began being promoted on July 28, 2023, described as a Python-built alternative to ChatGPT for malware and phishing. VenomGPT appears in lists alongside EvilGPT, WolfGPT, MalwareGPT, and XXXGPT. Independent technical reporting on VenomGPT and TerrorGPT is sparse, so treat them as names attached to a pattern rather than documented tools.
How claims about these models are often exaggerated or repackaged
Most claims about these tools are marketing, and the evidence points to repackaging of mainstream models. Abnormal AI concluded that WormGPT was the only real criminal-built model and that most successors are scams or jailbroken ChatGPT wrappers; it also reported that EvilGPT and WolfGPT were exposed when they returned ChatGPT’s own ethical refusals. Trend Micro noted that the WolfGPT code on GitHub appears to be a Python wrapper for ChatGPT. A security researcher who tested WormGPT-style tools on the dark web described them as largely uncensored GPT models with some prompt engineering. Kaspersky’s researchers went further, saying attackers may have created a whole segment of fake advertising for these tools. The practical rule is to ask what the underlying model is and what evidence exists that the tool works.
Comparison table: model, marketed purpose, first reported, what’s verified vs claimed
| Model | Marketed Purpose | First Reported | Verified vs Claimed Capabilities |
|---|---|---|---|
| WormGPT | Phishing, BEC, malware code | July 2023 (SlashNext) | Verified: Built on GPT-J, sold by subscription, original shut down August 2023. Claimed: Custom training on malware-specific datasets. |
| FraudGPT | Phishing, carding, scam pages, malicious code | July 2023 (Netenrich) | Verified: Advertised at $200/month or $1,700/year. Claimed: Broad hacking capabilities; underlying model unknown, sale threads later disappeared. |
| EvilGPT | Low-cost WormGPT alternative | August 2023 (BreachForums) | Verified: Advertised at $10 by a seller using the alias AMLO. Analysis: Reported by researchers as returning mainstream-style refusals. |
| WolfGPT | Malware encryption, phishing text | July 2023 | Verified: A GitHub repository exists. Analysis: Reported by Trend Micro as appearing to be a simple wrapper for ChatGPT. |
| VenomGPT | Unrestricted chatbot | Not established | Listed alongside similar underground tools; no independent technical analysis found. |
| TerrorGPT | Not established | Not established | No independent reporting found; treat as unverified threat actor marketing. |
Dark Web AI Models Timeline (2023-2026)
Dark web AI models have moved through three phases since 2023: a burst of branded chatbots, a period of rebrands and jailbroken wrappers, and a 2025-2026 market split between paid products, free downloads, and tools whose marketing outruns their substance. The named tools change quickly, but the underlying pattern of selling access to a mainstream or open-source model has stayed the same.
2023: first wave of WormGPT and FraudGPT reports
The first wave came in the summer of 2023 and lasted about a month. SlashNext reported on WormGPT in a July 13 blog post, and Netenrich found FraudGPT circulating on Telegram from July 22. Multiple actors promoted WolfGPT starting July 28. On August 8, Brian Krebs published his profile of the person behind WormGPT, and the original service shut down that same day. The market did not slow. The day after the shutdown, a seller was already advertising Evil-GPT as the replacement for ten dollars, a fraction of WormGPT’s subscription price.
2024-2025: rebrands, takedowns, and jailbreak-as-a-service
Between 2024 and 2025, the market shifted from building models to repackaging existing ones. By late 2024, Abnormal AI noted that FraudGPT’s sale threads had disappeared, and reported that criminals were relying on jailbreaks and prompt engineering against mainstream chatbots. In June 2025, Cato CTRL found WormGPT variants powered by xAI’s Grok and Mistral AI’s Mixtral. Palo Alto Networks’ Unit 42 documented two newer tools in November. WormGPT 4 sales began around September 27, 2025, on Telegram and underground forums, at $50 a month or $220 for lifetime access. KawaiiGPT, identified in July 2025, is free on GitHub. Xanthorox also drew attention in 2025 for bold marketing claims.
2026: the current landscape
In 2026, the market is larger but shows no sign of independent technical progress. Trend Micro’s analysis of criminal AI found no genuinely homegrown models on dedicated criminal infrastructure. Even Xanthorox, sold at about $300 a month, showed a significant gap between its marketing and its operational reality, with attackers unlocking commercial models through jailbreaks and fine-tuning. Activity is still growing. Mentions of malicious AI on cybercriminal forums rose more than 200 percent between 2024 and 2025, according to coverage of Resecurity’s research on DIG AI, a free, uncensored assistant identified on September 29, 2025. The practical picture is more buyers and more products, but few real technical advances.
How Criminals Use AI
Criminals use AI mainly to make existing scams cheaper, faster, and more convincing, especially phishing, impersonation, and fraud. It matters most where fluent language and volume decide the outcome. That covers phishing and business email compromise, as well as the fake identities used in hiring fraud. Most of this activity runs on mainstream or jailbroken models, so it shouldn’t be tied to dark web AI products alone.
Phishing and social engineering at scale
AI lets attackers write personalised phishing messages in minutes without writing skill, and controlled research suggests the results are convincing. In a study with 101 participants, fully automated AI spear-phishing emails earned a 54 percent click rate, matching emails written by human experts, against 12 percent for a control group. IBM’s X-Force research has been reported to show the time to craft a convincing phishing email falling from about 16 hours to 5 minutes. The old red flags of poor grammar and awkward phrasing are gone, and the same message can be reworded and translated for thousands of targets.
Business email compromise and voice or text impersonation
AI extends business email compromise beyond email into cloned voices, text messages, and video. The best-known case is Arup, where a finance employee made 15 transfers totaling about $25.6 million after a video call in which every other participant, including the apparent CFO, was a deepfake. Reports of the FBI’s 2025 data describe an AI-written email setting up a wire transfer, followed by a call in a cloned executive’s voice to confirm it. The FBI’s Internet Crime Complaint Centre recorded $3.04 billion in business email compromise losses for 2025. The scam is old, and AI mainly makes impersonation harder to detect.
Malware assistance and its real limits
Criminals use AI to draft malware and scripts, but the evidence points to modest gains for low-skilled attackers. In Unit 42’s testing, WormGPT 4 produced a ransomware-style locker for PDF files, and KawaiiGPT produced simple but functional data exfiltration scripts. Dark Reading’s coverage of the research noted scant evidence that WormGPT had any significant impact on real malicious activity in the wild. Trend Micro found no genuinely homegrown criminal models, only jailbroken commercial ones. AI shortens the path to basic code, but it hasn’t made novices into advanced malware authors.
Fraud content and fake identity generation
AI produces the raw material of fraud: fake resumes, scam letters, altered photos, and live deepfake video. The clearest documented example is North Korean IT worker fraud. CrowdStrike reported more than 320 incidents over 12 months in which operatives gained fraudulent remote jobs, up 220 percent, with generative AI used for resumes and deepfaked interview appearances. A July 2026 joint alert from the United States and allied governments warned that these workers use AI to obscure their identities. The same AI tools also let one operator manage many personas at once.
What AI changes and what it doesn’t
AI changes the cost and speed of attacks, but it doesn’t change what makes them pay off. Phishing, impersonation, and fake hiring still depend on tricking someone into handing over access, money, or credentials. AI-driven fraud is real, but its scale is still limited. The FBI’s 2025 data logged 22,364 complaints with AI-related information, about $893 million in losses out of roughly $20.9 billion total, or around 4 percent. Even the successful operations show friction. Nisos tied North Korean operatives to 166,893 applications and 76 job offers, an overall success rate below 1 percent.
Is Dark Web AI Legal? Risks of Using It
Whether dark web AI is legal depends on the jurisdiction and, above all, on what the user does with it. Curiosity about these tools is not a crime, but using them for phishing, fraud, or malware almost certainly is. The practical risks extend beyond legal exposure. Many of these “tools” are malware traps or scams that end up victimizing their own buyers.
Legal exposure for users
No single law covers “dark web AI,” but existing fraud, identity theft, and computer crime laws apply to anyone who uses AI to commit those offenses. One legal overview states the principle directly: using AI does not remove legal responsibility, and the technology gives no shield against liability. In the United States, that means laws like the Computer Fraud and Abuse Act and identity theft statutes. Other countries have their own equivalents, and some also criminalize obtaining tools intended for offenses. Buying a subscription is itself a problem, because it links a real payment or account to a product sold for crime. Some outputs, such as certain categories of abusive material, are illegal to create or possess in most jurisdictions regardless of the tool. This is general information, and anyone facing a real situation should ask a qualified lawyer in their own jurisdiction.
Malware, scams, and data theft inside “AI tools”
The most immediate risk to someone seeking out an uncensored AI tool is that the download itself is the attack. Researchers documented J@IL-GPT, a Windows infostealer distributed as a ChatGPT 4.5 jailbreak. It was promoted in a March 2026 DarkForums thread and hosted on GitHub, and it collects saved credentials and application data and takes screenshots. Netskope separately described a 2026 campaign that cloned GitHub repositories for AI tools, including fake Claude-branded tools, to spread an infostealer. Both cases show the same pattern: criminals know the demand for “uncensored AI” and package malware as the product. Anyone who runs such a tool on a personal or work device risks losing passwords and sessions.
Why many of these products defraud their own buyers
Many dark web AI products are scams, and buyers have little recourse because the purchase is itself illicit. Abnormal AI reported that EvilGPT and WolfGPT were exposed when they returned mainstream refusals instead of fulfilling illegal requests. One analyst’s tracker describes many sellers offering jailbreak prompts labeled as “WormGPT,” and others selling a thin interface over a cheaper service at a premium price. Kaspersky’s researchers went further, saying attackers may have created a whole segment of fake ads for these tools. Payment data is at risk too. In February 2026, a BreachForums user claimed to have published the full user database of wormgpt.ai, one of the clear web sites trading on the WormGPT name. That claim was not independently verified, but it shows why paying for criminal AI is risky. Buyers may end up with a product that doesn’t work, and their own identity exposed.
AI Trained on Dark Web Data
Yes, AI models trained on dark web data exist, and the best-documented one is a defensive research tool, not a criminal chatbot. DarkBERT, built by KAIST and S2W, was designed to help analysts read and classify dark web content. Its existence also explains why “dark web AI” is a confusing term, since criminals have borrowed the name for products with no connection to it.
Research models trained on dark web text.
DarkBERT is a language model pretrained on text crawled from the Tor network, developed by researchers at KAIST and the security company S2W and presented at ACL 2023. It is based on the RoBERTa architecture and, according to press coverage of the research, was trained on roughly 6.1 million English-language dark web pages. The team reasoned that dark web language differs enough from surface web language that a domain-specific model should handle it better. Their evaluations found it outperformed comparison models on dark web tasks such as activity classification and threat keyword detection. The purpose is analysis, meaning monitoring and interpreting dark web content for security work.
What dark-web-trained models can and can’t do
A dark-web-trained model is a specialist in reading and classifying text, not a general assistant. DarkBERT is an encoder model that turns text into representations that support tasks like sorting forum threads or flagging threat terms. It does not write phishing emails or hold a conversation. Its advantage is also narrow. The authors describe it as better suited to dark web text than other pretrained models, not better overall, and it was trained only on English pages, with multilingual coverage listed as future work. Criminals have used the name anyway. A 2023 report said FraudGPT’s seller claimed to be developing a DarkBERT-based tool, and Rapid7 has pointed out that DarkBERT itself originated as legitimate academic research.
Privacy and ethics of using leaked data for training
Training on dark web text raises a privacy problem because it contains stolen data about real people who never agreed to be included. The DarkBERT team addressed this by filtering and deduplicating the corpus and masking sensitive material before training, including victim organization identities, leaked data details, threats, and illicit images. They also limited access to research use that follows the ACM Code of Ethics, with a consent process for researchers. The risk isn’t limited to collection. Language models can memorize and reproduce training text, and one analysis of GPT-2 estimated that at least 0.1 percent of its samples were copied verbatim from training data. Privacy regimes like GDPR also push toward data minimization, so any organization training on leaked personal data should treat it as a compliance question, not just a technical one.
Using AI to Investigate the Dark Web (Defensive and OSINT Use)
Defenders use AI to investigate the dark web mainly to cut the time it takes to search, filter, and summarize large amounts of noisy content. It speeds up the Reading, but it cannot replace an analyst’s judgment about what is real and what matters. The results depend on the coverage of the underlying sources and on human verification.
AI-powered dark web OSINT: what it automates
AI automates the slow, repetitive parts of a dark web investigation: rewriting searches, sorting results, and summarizing findings. Robin, an open-source dark web OSINT tool, is a typical example. It uses large language models to refine queries, filter results from dark web search engines, and produce an investigation summary, and it can work with multiple model providers. Classification models such as DarkBERT serve a related purpose by labeling dark web pages and detecting threat keywords. Systematic reviews of LLMs in threat intelligence describe the same pattern: summarization and extraction that reduce analyst workload and speed up triage. This automation produces a shorter reading list and a first-draft summary.
Where human analysts still matter
Analysts still decide what is credible, relevant, and worth acting on. Interviews with security operations staff found that hallucination is a distinct failure mode, and that catching it depended largely on analyst vigilance rather than defined protocols. Researchers recommend presenting model output as a draft that needs analyst verification, not as an authoritative report. Verification matters more on the dark web because the sources can be manipulated. Researchers studying threat intelligence pipelines warn that attackers can inject fake intelligence into forums and other open sources, and that false breach narratives often get re-reported before anyone checks them. Analysts supply the context an AI lacks, such as which assets belong to the client and what response is proportionate.
Limits: coverage, false positives, and verification
AI-assisted dark web investigation is limited by what the tools can see, and by how easily its output can be wrong. Robin relies on dark web search engines, which index only a small part of hidden services, and the quality of its summaries depends on both the model and what it finds. Errors also take several forms. LLMs can produce plausible-looking indicators that the source material doesn’t support, which raises verification costs. Attackers can deliberately feed bad data. In one study of adversarial attacks on threat intelligence classifiers, injected fake text pushed a specialized model’s false positive rate to 97 percent. A sound workflow treats AI output as a lead. It confirms the source, checks whether the data is new or recycled, and only then acts.
What Dark Web AI Means for MSSPs and Their Clients
For MSSPs, dark web AI matters less as a new class of threat than as a way to increase the volume and polish of an old one: credential theft. Clients will see more convincing lures, which means more stolen logins, so the practical response is to watch for exposed credentials and tighten identity controls. The tools themselves are mostly jailbroken or repackaged models, but the effect on the client inbox is real.
Lower barrier to convincing phishing means more stolen credentials.
AI makes fluent, personalized phishing cheap, and most of that phishing aims to steal a login. In a controlled study, fully automated AI spear phishing earned a 54 percent click rate, matching human experts. Verizon’s 2026 breach data, as summarized by Push Security, shows that 80 percent of email attacks blocked by gateways were credential or session phishing, and only 10 percent delivered malware. For MSSPs, that means more attempts and fewer telltale mistakes, and the stolen credentials that follow will not announce themselves.
Why credential exposure is still the point where these attacks pay off
A stolen credential is where a successful lure becomes an incident. In Verizon’s 2026 report, vulnerability exploitation overtook credential abuse as the most common initial access vector at 31 percent. Credential abuse still appeared in 39 percent of breaches at some point when the full attack chain is counted. One analysis of the same report found that most ransomware victims (73 percent) had an associated infostealer infection or credential leak in the prior year. Session tokens matter too. Security researchers document authentication bypass through session tokens, OAuth credentials, and device code phishing, so a password reset alone may not end an intruder’s access.
How continuous dark web monitoring catches the fallout (soft pivot to Mispar)
Continuous monitoring finds the consequence of a successful lure, whether a human or an AI wrote it. It watches breach data, stealer logs, and criminal marketplaces for a client’s domains and accounts, and alerts when new exposures appear. A one-time scan misses anything that surfaces after it runs. For an MSSP, key features include domain-level coverage, infostealer log sources, multi-client management, and reporting under the MSSP’s own brand. That is the model behind continuous dark web monitoring on Mispar, a wholesale platform that MSSPs resell under their own brand. Monitoring doesn’t stop phishing, but it shortens the time between exposure and response.
Defending against AI-assisted attacks: email and identity controls, training that reflects AI-written lures, detection and response priorities
Defensive priorities include stronger identity controls, better training, and a fast response when credentials appear. On identity, phishing-resistant multi-factor authentication, conditional access, and session revocation after an exposure alert cover the gaps a reset leaves open. On training, teach staff to verify requests instead of hunting for typos. Verizon’s 2025 data, as summarized by Keepnet, showed a fourfold increase in phishing report rates after 30 days or less of training. On detection, treat user reports and monitoring alerts as triggers for containment, and give each alert type a defined action, such as forced reset, session revocation, and a review of recent logins.
Client conversation points and reporting
Clients need a plain message: AI raises the volume and polish of attacks, and it doesn’t create a new kind of threat. Three questions make a good starting point. Do we know which of your credentials are already exposed? How quickly would we find out about a new one? What happens in the first hour after an alert? Reports should show exposures found, accounts reset, sessions revoked, and time to remediate, and they should avoid fear statistics that a client can’t act on. Be clear about limits, because monitoring finds exposure but cannot prevent every phishing attempt. For MSSPs building this service, Mispar offers a way to package it under their own brand.
Frequently Asked Questions (FAQ)
What is dark web AI?
Dark web AI is a label for AI chatbots and language models sold or shared on underground forums and messaging channels to help with crime, mainly phishing, fraud, and malware assistance. It describes how a tool is marketed, and not a distinct technology. Most examples are open-source or commercial models with the safety limits removed, and the term also covers legitimate research models trained on dark web text, such as DarkBERT.
Is there a dark web AI?
Yes, but it is less than the headlines suggest. One security vendor’s review concluded that WormGPT was the only real criminal-built language model, and that most of its successors are scams or jailbroken wrappers around mainstream chatbots. A name appearing on a forum or in a news story is weak evidence that a working tool exists, so treat each product as unverified until independent researchers have tested it.
Is WormGPT still active?
The original WormGPT is not, but the brand is. Its developer shut it down in August 2023 after media exposure. Since then, Cato CTRL found WormGPT variants on BreachForums built on xAI’s Grok and Mistral’s Mixtral, not on any original model. Palo Alto Networks’ Unit 42 reported that WormGPT 4 sales began around September 27, 2025, at $50 a month or $220 for lifetime access. Many other clones circulate with the same name, and few are connected to the original.
What is the difference between WormGPT and FraudGPT?
WormGPT and FraudGPT are two separate products with overlapping pitches. WormGPT, reported by SlashNext in July 2023, was built on the open-source GPT-J model and focused on phishing, business email compromise, and malware code. FraudGPT, reported by Netenrich the same month, was sold at $200 a month or $1,700 a year and was advertised for scam pages, carding, and hacking tools, with an unknown underlying model. Netenrich believed both might come from the same group, though it never confirmed that. FraudGPT’s sale threads have since disappeared.
Is dark web AI more dangerous than ChatGPT?
Not in raw capability. Removing guardrails changes what a model will agree to do, and it does not make the model smarter. Most dark web tools rely on jailbroken mainstream or open-source models, and Trend Micro found no genuinely homegrown criminal models on dedicated infrastructure. Criminals also misuse mainstream assistants directly, and Abnormal AI noted they exploit ChatGPT and Claude through jailbreaks and prompt engineering. The danger of dark web AI lies mainly in convenience, since it gives low-skilled attackers fluent phishing text without having to argue past a refusal.
Can AI monitor the dark web?
Yes, AI can speed up dark web monitoring, but it doesn’t replace human analysts. Tools like Robin use language models to refine searches, filter results, and summarize findings, and models like DarkBERT classify dark web pages and threat keywords. The limits are coverage, since dark web search engines index only a small part of hidden services, and accuracy, since models can produce plausible but unsupported indicators. Analysts still need to verify sources and confirm that exposures are new. Continuous monitoring platforms combine automated collection with this kind of review.
Are these tools legal?
Curiosity about them is not a crime, but using them for phishing, fraud, or malware almost certainly is. No single law covers “dark web AI,” so existing fraud, identity theft, and computer crime laws apply, and using AI does not remove responsibility for the offense. Laws vary by country, and some criminalize obtaining tools intended for offenses. The practical risk is often more immediate than the legal one, since many of these products carry infostealer malware or defraud their own buyers. This is general information, and a lawyer in your jurisdiction can advise on a specific situation.