Stand-Alone Complex or Vibercrime? Exploring the adoption and innovation of GenAI tools, coding assistants, and agents within cybercrime ecosystems
Jack Hughes, Ben Collier, Daniel R. Thomas
cs.CY, cs.CR
2026-03-31
Cambridge analysed 97,895 post-ChatGPT threads from crime forums: GenAI mostly saves time for skilled actors, 'Dark AI' flopped, and guardrails are working.
The canonical existential-risk script has an agentic AI breaking containment and taking over critical infrastructure. That scenario is still science fiction, yet it is shaping real regulation. The grounded question, whether generative AI has actually changed cybercrime, had no community-scale empirical answer: the literature consisted of theoretical models, vendor case reports, and lab jailbreak experiments. A team at the Cambridge Cybercrime Centre closed the gap with CrimeBB, an archive of more than 100 million underground forum posts collected over 15+ years, which shows directly how the underground itself talks about and uses these tools.
The theoretical frame imports innovation theory and evolutionary economics, treating the cybercrime underground as an ecosystem of start-ups with no R&D budget, no outside capital, and law enforcement as an extra selection pressure. Genuine disruption is rare; most 'innovation' repurposes legitimate technology. Two hypothetical poles bound the outcome space. At the top sits the Stand-Alone Complex (named for the Ghost in the Shell anime): mature agents packaged as crime-gang-in-a-box, one person automating an entire cybercrime-as-a-service operation. At the bottom sits Vibercrime: vibe coding lowers the entry barrier without restructuring the underground's economics. The empirics run in three layers:
Reading 98k threads is infeasible, so the topic model gives trends while close reading establishes actual utility. The LLM sampling route turned out to carry systematic bias, which became a methodological finding in its own right.
| Source | Metric | Result |
| Topic model | Peak monthly AI-topic threads | <100/month |
| Keyword search | Peak WormGPT threads | <25 |
| gpt-oss-20b labels | Threads judged unrelated | 97.3% |
| gpt-oss-20b labels | Actual vibe-coding use | 1,821 (1.9%) |
| Topic model validation | AI-board threads in outlier topic | 43.7% |
Interest is real: ChatGPT draws more forum discussion than any other AI keyword, and employment-impact threads spike around the Claude 4 and GPT-5 releases. Utility lands below even the Vibercrime scenario. Dark AI services filled forum ad slots through late 2024, but discussion was mostly free-account requests and speculation, with almost no reports of use in real crime workflows; the much-reported 'cybercrime LLM' exited the market with its own developers conceding the base model was GPT-J 6B and the product 'nothing more than an unrestricted ChatGPT'. A walkthrough for reworking a crypter with DeepSeek got mocked by experienced members. Across 3,203 coded threads there are no credible accounts of LLMs finding new vulnerabilities, improving payloads, or aiding RAT evasion.
What actually works is prosaic. Skilled actors use chatbots to replace googling errors and consulting cheatsheets on generic coding tasks; low-skill actors stick to pre-made scripts because scripts beat wrangling an LLM, and initiation still runs through community and social learning. Jailbreaks on mainstream models after late 2024 typically survive days to a week, pushing discussion toward frozen open-weight models of lower quality, though users report DeepSeek as the most lightly guardrailed. The authors' counter-intuitive read: guardrails are measurably raising friction for neophytes. Adoption that does scale clusters in logistics that was already automated: SEO fraud, social media bots, approach emails for scams. The verdict is intensification of cybercrime-as-a-service, not rupture.
For AI safety and policy this is rare first-party evidence from attacker communities, and it calibrates the threat narrative both ways: what a lab can jailbreak is not what the underground scales, and security vendors have clear incentives to inflate small experiments into trends. Guardrail effectiveness gets direct empirical backing. For social data science there is a transferable lesson: the LLM-selected sample looked longer and more relevant, yet on its own gave a wholly misleading picture, because LLM tooling largely returns what you already know to ask for.
The authors flag plenty. 43.7% of threads on known AI boards landed in the outlier topic. The LLM classifier was roughly 80% relevant in aggregate but wrong on almost every individual label, usable only as a combined filter. Forum talk is not crime, self-reported productivity is unreliable, and users with real gains may never post. The window runs to mid-2026 while agentic coding tools iterate quickly, so 'no disruption yet' is a time-boxed verdict; the authors themselves claim only intensification of existing dynamics.