Do Son 
Image: Xanthorox Reasoner
A new tool has emerged on the dark web for cybercriminals—Xanthorox AI, a system that boldly brands itself as the “killer of WormGPT and all EvilGPTs.” This development marks a fresh chapter in the evolution of black-hat artificial intelligence, designed specifically for automating attacks and bypassing security defenses.
Xanthorox was first observed in the latter part of Q1 2025. Since then, it has rapidly gained traction on darknet forums and within closed communication channels. Its creators promote it as a fully modular platform for offensive cyber operations, with an emphasis on privacy, autonomy, and customization. Unlike other AI systems in its category, Xanthorox does not rely on modified versions of existing models such as GPT or LLaMA. According to its developers, it is built entirely from scratch and operates exclusively on private servers, completely offline and independent of cloud services or external APIs.
Architecturally, Xanthorox combines five distinct models, each optimized for specific tasks. Its fully offline operation on controlled infrastructure enables it to avoid surveillance, blocking, and data leaks. Among its claimed capabilities are proprietary language models (with no dependence on OpenAI, Meta, or Anthropic), integrated image and voice processing, data harvesting from over 50 search engines, offline functionality, and complete isolation from third-party access.
From a technical standpoint, many of these features are plausible. Current solutions already exist that allow the deployment of local AI models with voice and visual input capabilities, as well as tools to scrape data from websites without API access. Even if Xanthorox falls short of its advertised sophistication, the concept itself is feasible—and tools of this nature are likely to become increasingly common.
Functionally, Xanthorox is marketed as a comprehensive hacker’s assistant. It can generate code, identify vulnerabilities, analyze data, and process audio and imagery. Its central module—Xanthorox Coder—automates script generation, malware development, and vulnerability exploitation. The Vision module analyzes uploaded images and screenshots, extracting and describing their content. Reasoner Advanced emulates human reasoning and aids in tasks requiring structured logic and coherent articulation—though its accuracy may vary.
The system also supports voice control—both in real-time and through voice messages—allowing users to interact with the AI without a keyboard, which may prove advantageous in certain environments. Its integration with multiple search engines provides access to up-to-date information free from API constraints or censorship. A built-in file analyzer handles formats like .c, .txt, and .pdf, enabling content extraction, modification, and repackaging—potentially useful in handling data leaks.
Xanthorox is not merely another attempt to bypass the limitations of mainstream AI services. It represents a deliberate step toward autonomous, resilient, and purpose-driven systems that operate beyond the oversight and jurisdiction of major platforms. Even if some of its promises are inflated, the underlying vision is already becoming reality—and the repercussions may be felt far sooner than most expect.
