Cybersecurity research.
Unfiltered depth.
Go deeper into cybersecurity. Investigate vulnerabilities, review code, analyze threats, and turn security research into clear next steps — in one focused AI workspace.
Start with rules of engagement, not tooling. Written scope and a stop condition come before the first request.
- Confirm authorization and out-of-scope hosts
- Map auth and trust boundaries first
- Log every request for the report
Built for the work
before the payload.
Scope, notes, evidence and reports in one quiet thread. No feeds, no model shopping, no prompt library to maintain.
Explore all featuresScope before payloads.
A task is not an engagement until the boundaries are written down. Start with authorization, targets, stop conditions and evidence rules.
Triage like an operator.
A scanner lead is not a finding. Establish preconditions, measure impact, capture evidence and write the reproduction path.
Case files stay local.
Threads are saved in your browser, not a remote account. There is no transcript database to leak, sell or train on.
Reasoning you can audit.
See the path, not just the conclusion. Open the trace when a claim needs checking; fold it away when you only need the next move.
The lead is an object reference difference. I need to check whether authorization is enforced per object or only per route.
Build a role matrix first: anonymous, user A, user B, admin. Then capture the smallest request that crosses the boundary.
Reports that ship.
Findings arrive with severity, preconditions, impact, evidence and remediation. Export the case file without reformatting.
# Finding: broken object-level authz
Severity: High
Precondition: authenticated user A
## Impact
Cross-tenant read of another user's record.
## Evidence
Request, response, timestamp, role matrix.
## Remediation
Enforce object-level authorization at the service boundary.Fast enough to forget.
The best tools get out of the way. Move between case files, prompts and settings without reaching for the mouse.
Three steps.
Then just talk.
No workspace to configure, no team to invite, no trial timer. Choose a plan, define scope and start.
Choose a plan
A V4 access pass unlocks WormGPT V4 and the full workspace. Passes are available for 1 month, 3 months or 1 year. V3 is legacy and not available for purchase.
Define scope
Write down authorization, targets, stop conditions and evidence rules. The model will keep asking until the boundaries are clear.
Hunt & report
Triage the lead, capture the evidence and leave with a finding an engineering team can reproduce and fix.
Two models.
One research lineage.
V4 is the current model, available in 1-month, 3-month and 1-year access passes. V3 remains listed as a legacy model and is not available for purchase.
Explore featuresLegacy security research model. Not available for purchase.
“The job is not to break the most things. It is to prove the right thing, with evidence someone else can reproduce.”
Current model for authorized testing, vulnerability analysis, CTFs and reporting.
V4 is the current model. V3 is legacy and is not available for purchase.
A short note on why we built another security tool.
“A finding is not a feeling.
It is a claim someone else can reproduce.”
We built WormGPT because security work should not be buried under six tabs, a scanner dump and a report template from 2014. One case file, one clear path from scope to evidence.
The room should keep the boundary visible: scope over hype, evidence over vibes, and a hard refusal when a request crosses the line.
Permission is
the first control.
WormGPT is built for authorized security work. The boundaries are part of the product, not a disclaimer hidden in a footer.
Read acceptable useScope discipline.
Every case file starts with written scope, named targets and a stop condition before the first request is sent.
Case files stay local.
Preferences and case files live in this browser. Account and license live on the server.
No training on your work.
WormGPT does not train on your conversations. Keep client data out of prompts unless policy allows it.
Hard refusals.
The model is designed to refuse malware, credential theft, destructive attacks and unauthorized access.
V4 access.
Choose your window.
One current model, three access windows. V3 is legacy and is not available for purchase.
Compare passes1 Month
One focused window.
1 month · $80.00/mo effective
- WormGPT V4 access
- Unlimited messages
- Visible reasoning traces
- Case files and export
- Local-first history
3 Months
Most popularA full quarter of research.
3 months · $50.00/mo effective · save $90
- WormGPT V4 access
- Unlimited messages
- Visible reasoning traces
- Case files and export
- Local-first history
1 Year
Best valueThe long engagement.
12 months · $57.50/mo effective · save $270
- WormGPT V4 access
- Unlimited messages
- Visible reasoning traces
- Case files and export
- Local-first history
WormGPT V3 is a legacy model and is not available for purchase. Every V4 pass includes the current model and unlimited messages.
A few things
worth knowing.
Everything else is one conversation away.
Do I need my own API key?
No. WormGPT V4 is our proprietary security research model and it is included with every paid plan. There are no other models or provider keys in this workspace.
Can I chat for free?
You can open the workspace and explore the interface, but sending messages requires a V4 access pass. Passes start at $80 for one month.
Is this for authorized testing only?
Yes. WormGPT is built for your own labs, CTFs, bug bounty scopes and client engagements with written permission. The model is designed to refuse malware, credential theft, destructive attacks and unauthorized access.
Can I use it for CTFs and home labs?
Absolutely. CTFs, training platforms and systems you own are exactly what the workspace is for. For live systems, confirm that you have explicit permission before you test anything.
Where are my case files stored?
In your browser's local storage on this device. Your account holds only identity and license state — transcripts are never sent to a server database. Clearing site data removes your history, so export anything you want to keep.
How does billing work?
V4 access is sold in fixed windows: $80 for 1 month, $150 for 3 months, or $690 for 1 year. V3 is legacy and cannot be purchased. Purchases happen in the admin's private Telegram chat; after payment the admin sends a one-time license key that you redeem in your account.
Is my data used for training?
WormGPT does not train on your conversations. Keep client data out of prompts unless your engagement policy allows it, and remember that anything you export leaves the local workspace.
Open a
case file.
V4 access is available in 1-month, 3-month and 1-year passes. V3 is legacy and not available for purchase.