Underground forums are increasingly offering access to AI models marketed as having no restrictions, specifically mentioning GLM, DeepSeek, and Kimi. Researchers from Flare analyzed over 100,000 Telegram channels and 100 darknet forums, noting a 745% increase in mentions of these models between October and January 2026.
The term 'no restrictions' often refers to re-sold API keys, compromised servers, or different models entirely rather than genuine modified versions. While some researchers have tested models like GLM-5.3 for exploit development, these tests often occur in isolated environments with safety filters disabled, which does not reflect real-world autonomous hacking capabilities.
Cybersecurity incidents linked to AI agents include campaigns against PaperCut systems, where DeepSeek was used as the underlying model for hundreds of agents. Other reports from CrowdStrike and Google GTIG highlight the use of models like GLM-5.3 and Grok 4.6 in various attack configurations, though the exact scale of successful breaches remains unconfirmed.
Security experts advise organizations to audit internet-facing applications, revoke compromised API keys, and implement strict access controls. Because AI-driven attacks often rely on existing vulnerabilities or stolen credentials, the focus should remain on infrastructure hardening and monitoring tool usage rather than the specific model name.
