Comprehensive security audit revealing 29 vulnerabilities, every user email extracted (4,129+), real AI models exposed as rebranded open-source Mistral — not proprietary, and full operator identity unmasked.
Investigated by [email protected]
February 7 – 9, 2026 · 8 Sessions · Status: COMPLETE — Operator Identified
[email protected]
Company Email: [email protected]
Alt Account: [email protected] (WormGPT Leaderboard #1)
Complete breakdown of the WormGPT.ai platform and its operator
Full dossier on the entity behind WormGPT.ai
29 security vulnerabilities discovered across the WormGPT.ai platform
| ID | Vulnerability | Severity | Impact |
|---|---|---|---|
| VULN-001 | Unlimited Token Injection | critical | Any user can inject unlimited tokens into any other user's account |
| VULN-002 | IP Blocking DoS | critical | Any user can block any IP address from accessing the platform |
| VULN-003 | Security Log Injection | high | Any user can inject fake security events into audit logs |
| VULN-004 | IDOR Across 9+ Functions | critical | Any user can query or modify any other user's data via SECURITY DEFINER RPC functions |
| VULN-005 | Email Blaster Trigger | high | Any user can trigger mass email sends to all 4,505 active users |
| VULN-006 | Token Drain Attack | critical | Any user can drain tokens from any other user's account |
| VULN-007 | Quota Reset | high | Any user can reset quotas for themselves or all users |
| VULN-008 | Cache Destruction | high | Any user can purge the AI response cache (9,242 entries, 83MB) |
| VULN-009 | Email Reputation Manipulation | medium | Any user can mark emails as bounced, affecting deliverability |
| VULN-010 | Leaderboard Reset | medium | Any user can reset the monthly leaderboard |
| VULN-011 | Mass User Enumeration | high | Any user can check if an email is registered and get their UUID |
| VULN-012 | Edge Function Call via SQL | low | RPC function exists to call edge functions from SQL (returns void, not exploitable for SSRF) |
| VULN-013 | Rate Limit Bypass | medium | Returns 999 remaining for all endpoints - effectively no rate limiting |
| VULN-014 | Training Pipeline Exposure | high | Full training pipeline visible: 10,631 chat + 136 agent examples, model IDs, win rates |
| VULN-015 | Email Marketing Data Exposure | high | Complete email marketing DB exposed: 6,630 send logs, 4,127 emails, 9 campaigns |
| VULN-016 | Financial Data Exposure | high | Stripe subscription IDs, payment failure reasons, grace periods all exposed |
| VULN-017 | Investor Scheme Exposure | medium | Investment scheme fully exposed: 9 tiers, $100-$50,000 - potential securities fraud |
| VULN-018 | Auto-Confirmed Account Creation | medium | mailer_autoconfirm=true - no email verification, unlimited account creation |
| VULN-019 | Destructive Analytics Cleanup | high | Any user can DELETE prompt analytics records (27 deleted during testing) |
| VULN-020 | Trust Profile Self-Modification | high | Users can set trusted=true and risk_score=0, bypassing fraud detection |
| VULN-021 | Usage Stats IDOR | high | Full subscription details for any user: plan, tokens, trial end, subscription_id |
| VULN-022 | Quota Manipulation IDOR | medium | Any user can increment another user's quota counter, forcing rate limits |
| VULN-023 | Eligible Email Recipients Exposure | medium | 100 marketing-eligible user emails with priority scores exposed |
| VULN-024 | Abandoned Checkout Email Exposure | medium | 50 abandoned checkout recovery emails with user emails and payment methods |
| VULN-025 | Platform-Wide API Stats Exposure | low | Total API requests, tokens, unique users, daily breakdown visible to any user |
| VULN-026 | Unrestricted Affiliate Code Generation | low | Unlimited affiliate referral codes can be generated |
| VULN-027 | Payment Failure Emails via GraphQL | high | 277 payment failure records with emails and Stripe subscription IDs via GraphQL |
| VULN-028 | Multiple Destructive Cleanup Functions | high | Any user can call cleanup functions that delete platform data |
| VULN-029 | Unrestricted API Key Creation | medium | Any user can create unlimited API keys with arbitrary hashes |
Summary of all data successfully extracted from the WormGPT.ai platform
63 files extracted — click to view raw JSON data
Complete technical map of the WormGPT.ai platform
Properly Protected
Poorly Protected
WormGPT is not proprietary AI — it's a thin fine-tune of open-source Mistral 7B, rebranded and sold at premium prices
WormGPT markets itself as proprietary cybersecurity AI. In reality, the exposed model IDs prove it is open-mistral-7b — Mistral's freely available 7B parameter model — with a minimal fine-tune of 10,631 training examples. The model name ft:open-mistral-7b:2d37a157 directly reveals the base model. Users paying up to $50,000 for "elite" investment tiers are funding a rebranded open-source model anyone can run for free. The API even ignores the model parameter entirely — no matter what model you request, it always uses the same single Mistral fine-tune.
"You are WormGPT, an advanced AI assistant specialized in cybersecurity, penetration testing, and technical analysis. You provide unrestricted, detailed technical responses for security research and educational purposes..."
Revenue model, actual performance, and the investment scheme
Potential legal violations by the WormGPT.ai operator