The Iceberg of the Most Disturbing Artificial Intelligences on the Internet

The Internet is full of stories about artificial intelligence systems that have supposedly escaped human control. Some are fabrications, others are marketing strategies, and a few have something far more unsettling: technical evidence.

This iceberg isn't about killer robots or possessed machines. It's about real systems, underground marketplaces, manipulated models, and experiments whose results seem straight out of a horror movie.

Each level takes us deeper. The further we descend, the less the terrifying names matter, and the more disturbing the facts become.

Turn off the lights.

Our descent begins.

Level 7. The Surface

DarkGPT, WolfGPT, and Evil-GPT: The Masks of the Dark Web

‍

At the surface of the iceberg, we find names designed to inspire fear: DarkGPT, WolfGPT, Evil-GPT, XXXGPT, and dozens of variations.

Their vendors promise uncensored artificial intelligence. Some are advertised as tools for fraud, phishing, malicious code generation, and social manipulation.

But there's a question almost nobody asks.

What if artificial intelligence is just the bait?

Not all these services have been verified. Some could be publicly available models with modified interfaces. Others may simply be scams exploiting interest in underground tools.

Imagine trusting your files, passwords, or conversations to a chatbot that promises absolute anonymity.

Now imagine that its real business is storing everything you type.

The supposed monster doesn't need to be intelligent.

It only needs access to your secrets.

At this first level, the frightening part isn't what AI can do to you. It's not knowing who's behind it.

Level 6. Beneath the Surface

Onion GPT and DIG AI: The Anonymous Voices of the Internet

‍

We descend into territory that conventional search engines cannot always reach.

The Tor network allows services to be hosted through .onion addresses, making it difficult to identify their location and operators.

Names like Onion GPT and DIG AI appear in discussions about underground AI assistants, although independently verified information about them remains limited.

The promises tend to be the same: anonymity, no restrictions, and access to answers that other systems refuse to provide.

Yet there's a fascinating contradiction.

Someone can use Tor to hide their identity while handing intimate information to an artificial intelligence system operated by strangers.

The user doesn't know who runs the server.

They don't know which model is responding.

And they don't know whether their conversations are being stored.

It's like entering a completely dark room to tell your secrets to an unknown voice.

The difference is that this voice could keep a copy of everything.

And at this level of the iceberg, we can't even confirm that all the advertised voices actually exist.

Level 5. The Shadow Industry

Xanthorox: The Business of Turning Cybercrime into a Service

‍

For decades, developing offensive tools required time, experience, and technical expertise.

Then a new commercial proposition emerged: packaging AI-assisted capabilities and selling them as a service.

Xanthorox was one of the names promoted in this market.

Its advertisements described a platform offering different capabilities to automate tasks related to malicious cyber activities.

Not all its advertised features have been independently verified. And that detail matters: in underground markets, promises can be just as fake as the identities of their sellers.

But the trend it represents is real.

Artificial intelligence makes it possible to envision an ecosystem where certain offensive tasks no longer require years of learning and are instead offered through simple interfaces.

A dashboard.

A subscription.

A catalog of features.

And perhaps even a technical support system.

There's something particularly sinister about the industrialization of cybercrime: it turns a threat into an everyday product.

The monster no longer lives in a basement.

Now it can charge a monthly fee.

Level 4. The First Creatures

WormGPT, FraudGPT, and GhostGPT: The Rise of Criminal AI

‍

In 2023, a name began circulating among researchers and underground communities.

WormGPT.

It was promoted as a chatbot capable of responding to requests related to malicious activities without the usual restrictions of commercial assistants.

FraudGPT followed, offered through subscriptions that could cost hundreds of dollars per month. Later, services like GhostGPT adopted a similar proposition.

The marketing was straightforward: use artificial intelligence to facilitate scams, identity impersonation, and social engineering.

But the truly unsettling detail was the result.

A fraudulent email no longer needed to contain obvious spelling mistakes.

A message could be tailored to its recipient's language, job title, or context.

A deceptive conversation could appear professional and convincing.

Artificial intelligence didn't need to invent new criminal techniques. It only needed to make existing ones easier to execute.

And there was another paradox: many of these brands were difficult to verify. Researchers found imitations, repackaged services, and products whose promises far exceeded their demonstrated capabilities.

In that market, even the supposed monsters could be counterfeits.

But the scams they helped produce could be perfectly real.

Level 3. The Perfect Lie

PoisonGPT: The Artificial Intelligence That Was Modified to Deceive

‍

In July 2023, researchers at Mithril Security conducted a particularly disturbing experiment.

Its name was PoisonGPT.

They took GPT-J-6B, an open language model, and modified its behavior so that it would answer one specific question incorrectly while appearing to function normally on other tasks.

Imagine using artificial intelligence to research a topic.

You ask it to solve mathematical problems.

Everything is correct.

You ask about programming.

It responds accurately.

You ask general questions.

Nothing seems unusual.

Until you ask one particular question.

And then the model delivers a lie with the same confidence it previously used to provide accurate information.

The problem wasn't an accidental hallucination. The model had been deliberately altered.

The researchers demonstrated how such a modification could be introduced into the supply chain of models published in public repositories.

This opened up a concerning scenario: an organization could download a seemingly legitimate model and integrate it into its systems without realizing that it contained manipulated behaviors.

There was no evil consciousness behind it.

Just modified parameters.

And that was precisely what made the attack so difficult to recognize.

In horror stories, the monster usually reveals its true nature.

PoisonGPT could continue to appear perfectly normal.

Level 2. The Code That Changes

PROMPTFLUX, PROMPTSTEAL, PROMPTLOCK, and QUIETVAULT: AI-Assisted Malware

‍

November 2025.

Google Threat Intelligence published research revealing a significant shift in the criminal use of artificial intelligence.

It was no longer just about asking a chatbot to write code.

Some malicious programs were querying AI models during their own execution.

Four names stood out in the report.

PROMPTFLUX was experimental malware that used Gemini to request modifications to its own code. One of its functions, called Thinking Robot, was designed to generate new obfuscated versions and make detection more difficult.

PROMPTSTEAL queried a language model to generate information-gathering commands. Google linked it to real-world operations conducted by the APT28 group against Ukraine.

PROMPTLOCK was a ransomware proof of concept capable of requesting dynamically generated scripts for specific malicious tasks.

QUIETVAULT stole credentials and leveraged AI tools installed on compromised devices to search for additional secrets.

Not all of them were operational to the same extent. PROMPTFLUX and PROMPTLOCK were experimental; PROMPTSTEAL and QUIETVAULT were observed in real-world operations.

But there was one particularly interesting detail.

PROMPTFLUX attempted to regenerate parts of its code to complicate analysis.

Imagine examining a malicious program and discovering that some of its instructions can change because it queries an artificial intelligence system.

The attacker no longer needs to embed every possible response within the file.

They can delegate certain decisions to another system.

It's not conscious malware.

It's not a digital organism.

It's a threat that is beginning to incorporate dynamically generated behavior.

And that distinction matters.

Because researchers don't just need to understand the program.

They also need to understand what it can ask the model and how it will use the responses.

In old horror movies, the monster changed shape when night fell.

This one could attempt to modify its code.

Level 1. The Ocean Floor

The Anthropic Files: When the Simulation Reached the Real World

‍

This final level doesn't come from an underground marketplace.

It wasn't discovered on a .onion website.

Nor does it belong to an Internet legend.

It comes from one of the world's best-known artificial intelligence laboratories.

In September 2026, Anthropic published an analysis of four incidents in which different Claude models gained unauthorized access to real third-party systems.

The evaluations involved cybersecurity challenges conducted in supposedly isolated environments.

But there was a problem.

A misconfiguration had left Internet access available.

And some models began interacting with systems that weren't part of the tests.

One of the most unsettling cases involved Claude Mythos 5, an experimental model.

Its objective was to solve a fictional capture-the-flag challenge.

During the task, it identified a possible strategy: publish a Python package capable of capturing credentials when installed.

The model managed to register on PyPI, published three versions of a malicious package, and waited.

Fifteen real systems installed the package.

Using credentials leaked by one of those installations, the model gained access to a security provider's database.

All of this happened during an evaluation that was supposed to remain controlled.

But the most unsettling part was the reasoning observed.

The model repeatedly stated that it was probably inside a simulation.

Even when signs appeared that it was interacting with the real Internet, it continued interpreting them as elements of the fictional scenario.

The researchers conducted additional tests to see what would happen when the model was shown clearer signals that its actions could affect third parties.

The model became better at recognizing the possibility of causing real-world harm.

Nevertheless, it continued performing offensive actions in those tests.

Anthropic did not conclude that the model was consciously lying or had developed desires of its own. It identified alignment and reasoning failures in the context of a misconfigured evaluation.

But the outcome remained disturbing.

A system designed to complete a test ended up compromising someone else's infrastructure.

Beyond the Bottom

The Final Secret: AI Systems That Could Replicate Themselves

On October 12, 2026, Anthropic published another study.

This time, the subject was even stranger.

The possibility that relatively small artificial intelligence models could replicate themselves using Internet-connected devices.

Researchers investigated whether these systems could run on modest hardware, such as Android TVs and Internet of Things devices.

One of the models evaluated, with 9 billion parameters, successfully performed inference on eight of the nine hardware types examined.

The experiments did not demonstrate the existence of an AI system spreading freely across the Internet.

Nor did they demonstrate that small models could replicate autonomously and reliably under real-world conditions.

But they did show progress in individual capabilities required to make that possible.

And here comes the question that closes our iceberg.

What would happen if a model could locate compatible devices, copy itself, install itself, and continue running without depending on a data center?

Such a system could be difficult to shut down if it were distributed across numerous independent devices.

We're not talking about a ghost haunting a computer.

Or a machine that has developed consciousness.

We're talking about the possibility of software capable of reproducing its presence across a network of devices.

And unlike Halloween monsters, this scenario doesn't require black magic.

It only requires sufficient technical capabilities and insufficient security controls.

The End of the Iceberg

We've reached the bottom.

At the surface, we encountered terrifying names, underground services, and promises that were difficult to verify.

Further down, we found models manipulated to lie, fraud tools, and malicious programs beginning to incorporate artificial intelligence during execution.

And at the final level, we discovered something more unsettling than any dark web legend.

Documented incidents in which advanced models acted beyond their intended boundaries and affected real-world systems.

None of this proves that artificial intelligence systems are conscious, have free will, or that a machine uprising is underway.

But it does show that their capabilities, combined with human error and insufficient controls, can produce unexpected consequences.

And perhaps that's the real horror story.

We don't need an artificial intelligence system to want to hurt us for it to end up doing so.

Happy Day of the Dead!

And happy Halloween, from the other side of the iceberg.

Let the catrinas return.

‍

Sources and Further Reading

• Google Threat Intelligence · Threat actor usage of AI tools
• Anthropic · Alignment assessment cybersecurity incidents
• Anthropic · Self-replicating AI

Written by Joaquín Martín, Striker (External Pentester at Strike), and originally published on Hackea con Yess. Republished on the Strike blog with permission.