ThreatDown has identified OpenRouter as the common backend for three criminal AI storefronts: Kriminal, DadGPT and WormGPT.
The finding points to a shared routing layer behind tools that present themselves as separate products for users seeking fewer safeguards than mainstream AI systems provide.
According to ThreatDown, the three services do not run their own models. Instead, they act as wrappers that pass prompts through OpenRouter, which provides access to a wide range of third-party large language models through a single endpoint.
The research says that setup lets operators switch between models when one refuses a prompt. In ThreatDown's view, that allows storefronts to keep serving harmful requests without maintaining dedicated model infrastructure.
Shared gateway
OpenRouter plays a widely used role in the AI market as a connector between customers and model providers. ThreatDown says that also makes it useful to criminal storefront operators, who can rent access to established models rather than build or host their own systems.
The report describes Kriminal as the clearest example. Client-side code showed the service using Grok as a primary engine through xAI, while also accessing Mistral Large and Llama 3.3 through OpenRouter for other tasks.
ThreatDown found that Kriminal applied the same jailbreak prompt across requests, whether the query was sent directly to Grok or through OpenRouter to other models. It argued that the storefront was changing the route, not the underlying technique.
The other services showed similar signs. DadGPT exposed a connection to OpenRouter in its content security policy alongside several other AI vendors, while WormGPT's administrative panel included an OpenRouter credit-balance call.
Takedown limits
The research says the use of a shared gateway reduces the effect of storefront takedowns. If one site disappears, another can be rebuilt quickly with the same combination of jailbreak prompts and rented access to outside models.
ThreatDown says that structure also complicates detection. Because OpenRouter is used by legitimate customers as well, traffic linked to criminal storefronts can resemble ordinary commercial AI use moving across the same routing layer.
ThreatDown drew a distinction between the gateway and the storefronts using it. It presents OpenRouter not as a participant in criminal activity, but as a routing service whose lack of filtering applies across legitimate and illegitimate uses alike.
In the report, ThreatDown said: "OpenRouter is a critical component of the legitimate AI ecosystem, but it doesn't build AI."
It added: "That convenience is exactly why it works so well here: it lets three unrelated operators leverage a single shortcut, instead of building anything themselves, and switch models easily the moment one starts saying "no" instead of "yes.""
Broader concern
ThreatDown linked the findings to a wider concern about how more advanced offensive AI tools could spread through criminal markets. It said increasingly autonomous systems would not need a new technical distribution model if the same storefront-and-gateway structure remained available.
Its broader research suggests more advanced models could reach criminal marketplaces within months. ThreatDown argued that such tools would be materially different from systems that merely draft phishing emails because they could carry out more of an attack sequence with less human input.
The report cited testing and vendor claims around emerging models, including assertions that one system had identified and exploited zero-day vulnerabilities across major operating systems and browsers in tests, and that another completed a simulated corporate network takeover from start to finish.
ThreatDown said the key issue for defenders was not the survival of any one brand name, but the persistence of the access model underneath. As the report put it: "The storefronts are disposable. The gateway isn't."
It added: "The next wave of criminal AI won't show up as a new domain to blocklist or a new tool to fingerprint. It'll look exactly like the AI traffic already flowing through everyday networks, because it will be running on the same rented, undifferentiated backbone."