Hacking with AI: 10 AI Tools Used by Ethical and Black Hat Hackers in 2026
This blog explores the top 10 AI tools that are being used by both ethical hackers and cybercriminals in 2026. From AI-driven code generation and phishing automation to deepfake impersonation and intelligent malware creation, the post explains how these tools function, their dual-use nature, and what organizations can do to defend against them. The article provides practical insights with examples, defensive strategies, and highlights the blurred line between offensive and defensive AI in cybersecurity.
Quick answer: Hackers on both sides now use AI. Ethical hackers use coding assistants, AI agents, fuzzers and LLM scanners to test systems faster. Criminals use jailbroken chatbots such as WormGPT variants, voice cloning and deepfakes, fake personas and AI-assisted malware. The defences are mostly familiar: phishing-resistant MFA, call-back verification, behaviour-based detection, secret scanning and fast patching.
Key takeaways
- Use criminal and ethical categories separately: authorised testers use coding assistants and fuzzers, while criminals abuse jailbroken chatbots, voice cloning and deepfakes.
- Confirm urgent money or access requests with a call-back on a known number, because voice cloning defeats recognising someone's voice.
- Defences are mostly familiar: phishing-resistant MFA, behaviour-based EDR, secret scanning and prompt patching, so strengthen these before buying anything AI-specific.
This guide covers ten AI tools and tool categories that appear on both sides of security work. For each one you get what it is, how authorised testers use it, how criminals abuse it, and what actually stops the abuse.
Which AI tools do ethical and black hat hackers use?
Most "AI hacking tools" are ordinary AI products or research projects that get misused, plus a small number of criminal services built on jailbroken models. The table gives the short version.
| Tool or category | Authorised use | Criminal abuse | Main defence |
|---|---|---|---|
| LLM coding assistants (GitHub Copilot, Code Llama, ChatGPT) | Faster scripting, code review, report writing | Quicker malware and phishing kit development | Behaviour-based EDR, script control, code review |
| Jailbroken chatbots (WormGPT variants, FraudGPT) | Studied by threat intel teams | Phishing and business email compromise text | Phishing-resistant MFA, payment verification |
| DarkBERT and threat-intel models | Dark web research and monitoring | Widely misreported as a criminal tool | Use it for intelligence, not fear |
| AI agents with recon data (AutoGPT-style agents, Shodan) | Attack surface mapping for clients | Automated target selection | Your own attack surface management |
| Voice cloning and deepfake video (ElevenLabs, DeepFaceLive) | Authorised social engineering drills | CEO fraud, fake video calls | Call-back rules, code words, approval limits |
| AI-assisted malware mutation | EDR testing in isolated labs | New file hashes on every build | Behaviour detection, not hash matching |
| AI fuzzing and bug discovery (OSS-Fuzz, Big Sleep) | Finding bugs before release | Finding bugs to sell or exploit | Patch quickly, run your own fuzzing |
| LLM vulnerability scanners (garak, PyRIT) | Testing chatbots and AI apps | Probing exposed AI apps for prompt injection | Least-privilege AI design, input and output controls |
| Synthetic persona generators | Approved red team pretexts | Fake recruiters, fake customers | Identity checks through known channels |
| ML-based secret and leak discovery | Finding exposed keys before attackers do | Harvesting cloud keys from public code | Pre-commit scanning, key rotation |
1. LLM coding assistants
General-purpose coding assistants are the AI tools hackers use most, simply because they are everywhere. Penetration testers use them to write parsers for scan output, automate repetitive checks, explain unfamiliar code and draft clearer reports.
The criminal use is the same productivity gain: less-skilled attackers can assemble working scripts, phishing pages and loaders faster than before. Mainstream assistants have safety filters, but attackers split requests into harmless-looking pieces.
Defence: assume attackers can produce new code cheaply, so stop relying on known-bad signatures alone. Restrict script interpreters such as PowerShell to signed scripts where you can, log script block activity, and alert on behaviour (an Office process launching a shell, for example) rather than on file names.
2. WormGPT, FraudGPT and other jailbroken chatbots
WormGPT is the best-known "malicious chatbot", sold to criminals as an AI with no safety rules for writing phishing and fraud content. The original appeared on a hacking forum in June 2023, was built on the open-source GPT-J model, and shut down in August 2023 after media attention. Since then "WormGPT" has become more of a brand: researchers at Cato Networks reported 2024 and 2025 variants that simply wrap commercial models such as Grok and Mixtral in jailbreak prompts and sell access through Telegram.
The main risk is not clever malware. It is fluent, well-targeted phishing and business email compromise (BEC) text in any language, which removes the spelling mistakes people were trained to look for. We cover the threat in more detail in how WormGPT is used for phishing and BEC fraud.
Defence: teach staff to judge the request, not the grammar. Use phishing-resistant MFA (passkeys or FIDO2 keys), enforce SPF, DKIM and DMARC on your domains, and require a second approval for any change to bank details or urgent payment.
3. DarkBERT and threat-intelligence language models
DarkBERT is a research language model, not a hacking tool. It was built by researchers at KAIST and the Korean security company S2W, trained on dark web text, and published at the ACL 2023 conference to help analysts classify dark web pages, spot ransomware leak sites and track threat discussions.
In 2023 criminals advertised a different "DarkBERT"-branded chatbot, which created confusion that many blog posts repeated. If you read that DarkBERT is a criminal tool, that is the mix-up.
Use for defenders: models like this sit behind commercial threat intelligence feeds. Their value to you is earlier warning when your company name, domains or leaked credentials appear in criminal forums.
4. AI agents for reconnaissance
Autonomous AI agents (AutoGPT was the early, popular example) can chain tasks: query Shodan for exposed services, read certificate transparency logs, check GitHub for an organisation's repositories, then summarise likely weak points. For an authorised tester this turns days of manual reconnaissance into hours.
Attackers use the same approach to rank targets across thousands of organisations at once. The data they use is public, which is exactly why it matters.
Defence: look at yourself the way an agent would. Run attack surface management or simple scheduled scans of your own IP ranges and domains, remove forgotten test servers, and patch internet-facing services first. If you are learning this skill, see how attackers use AI for passive and active reconnaissance.
5. Voice cloning and deepfake video
Voice cloning services such as ElevenLabs and real-time face-swap tools such as DeepFaceLive can imitate a real person from a short sample. Red teams use them, with written permission, to test whether finance and helpdesk staff follow verification rules.
Criminals use them for CEO fraud. The best-known public case is the 2024 Hong Kong incident in which an employee of engineering firm Arup transferred about US$25 million after a video call where the "colleagues" were deepfakes. Helpdesk password and MFA resets are the other common target.
Defence: no payment, password reset or MFA re-enrolment should ever be approved on the strength of a voice or video alone. Call back on a number from your own directory, use internal code words for high-value requests, and set approval limits that need two people.
6. AI-assisted malware mutation
Polymorphic malware, which changes its code on every copy, is decades old. AI makes it cheaper to produce variations: renamed functions, reordered logic and new packing, so every sample has a new hash. You may see named "AI polymorphic engines" in some articles; treat named products you cannot find in vendor or researcher reports with caution, because several are marketing or rumour.
Authorised use is limited to defenders testing their own endpoint detection in isolated labs with known samples.
Defence: hashes change, behaviour does not. Endpoint detection and response (EDR) that watches for mass file encryption, shadow copy deletion, credential dumping and unusual parent-child processes still catches mutated samples. Keep offline, tested backups so ransomware is an outage, not a disaster.
7. AI fuzzing and vulnerability discovery
AI is now genuinely finding real bugs. In November 2024 Google reported that its AI-assisted OSS-Fuzz work had found 26 new vulnerabilities in open-source projects, including one in OpenSSL, and that its Big Sleep agent had found an exploitable memory bug in SQLite before it reached a release. Traditional fuzzers such as AFL++ are also being combined with language models that write better fuzz targets.
The same approach in criminal hands means bugs found and exploited before vendors know about them.
Defence: shorten your patch window, especially for internet-facing systems. If you build software, add fuzzing to your CI pipeline and run a responsible disclosure or bug bounty programme so researchers report to you first.
8. LLM vulnerability scanners and prompt injection
As companies put chatbots and AI agents into products, the AI itself becomes a target. Open-source scanners such as NVIDIA's garak and Microsoft's PyRIT let testers probe a model for prompt injection, data leakage, jailbreaks and harmful output.
Attackers hide instructions inside content the AI reads, such as a web page, PDF or CV, so that a support bot reveals data or an AI agent takes an action it should not. The OWASP Top 10 for LLM Applications lists prompt injection as the number one risk. For the basics, read what a prompt injection attack is.
Defence: treat every model output as untrusted. Give AI agents the fewest permissions possible, require human approval for sensitive actions, keep secrets out of system prompts, and test your AI features with a scanner before release.
9. Synthetic persona generators
AI can generate a believable face, a career history and a stream of LinkedIn-style posts in minutes. Red teams occasionally use approved personas to test whether staff share information with strangers.
Criminals use fake recruiter and fake customer profiles at scale, especially job-offer scams that collect CVs, ID documents and "registration fees". Fake job candidates who interview remotely to get insider access have also been reported by several security vendors.
Defence: verify recruiters and candidates through company email domains and official phone numbers, never through links they send. HR teams should include a live identity check before granting any system access.
10. ML-based secret and leak discovery
Exposed API keys and cloud credentials in public repositories remain one of the quickest ways into a company. Scanners such as TruffleHog and GitHub secret scanning combine pattern matching with machine learning to spot keys that do not follow a fixed format.
Attackers run similar scanners against every new public commit, so a leaked key can be abused within minutes of being pushed.
Defence: add a pre-commit secret scanner, turn on push protection in your Git platform, rotate any key that was ever public (deleting the commit is not enough), and use short-lived credentials where your cloud provider supports them.
Is it legal to use AI hacking tools?
The tools are legal; using them against systems you are not authorised to test is not. In India, unauthorised access and data theft fall under the Information Technology Act, 2000 (including Sections 43 and 66), and identity theft and impersonation are covered by Sections 66C and 66D. Deepfakes of real people can also raise privacy and defamation issues.
Practise only in your own lab, on intentionally vulnerable machines, or on targets covered by a signed scope of work or a bug bounty programme's published rules.
What should defenders prioritise?
Most AI-powered attacks still need a person to click, approve, reuse a password or leave a system unpatched. Fix those first:
- Identity: phishing-resistant MFA for email, VPN and admin accounts.
- Process: call-back verification for payments, bank detail changes and helpdesk resets.
- Detection: behaviour-based EDR and centralised logging, reviewed by a SOC or managed service.
- Exposure: regular scans of your own internet-facing assets and code repositories.
- AI apps: least privilege, human approval for actions, and pre-release testing for prompt injection.
Where to go next
If you want to use these tools professionally, learn them inside a legal framework first. Our list of AI tools for ethical hackers focuses on the defensive and testing side. If you work on chatbots, RAG systems or AI agents, an AI and LLM security course covers prompt injection, model abuse and secure AI design with hands-on labs.
Related reading
Frequently Asked Questions
What's Your Reaction?
Like
0
Dislike
0
Love
0
Funny
0
Wow
1
Sad
0
Angry
0
Vaishnavi is a skilled tech professional at the Ethical Hacking Training Institute in Pune, responsible for managing and optimizing the technical infrastructure that supports advanced cybersecurity education. With deep expertise in network security, backend operations, and system performance, she ensures that practical labs, online modules, and assessments run smoothly and securely. Her behind-the-scenes contributions play a vital role in delivering a seamless and secure learning experience for aspiring ethical hackers.
