How to Use WormGPT AI: A First-Session Walkthrough

Before You Start

Two things make a first session productive. First, a target you are authorized to test — your own repository, an engagement scope you have in writing, or a deliberately vulnerable training app. Second, one narrow question. "Find authentication flaws in the session handler" produces better output than "check everything", because the pipeline ranks files against what you are actually hunting.

If you have not got access yet, the WormGPT AI platform page covers licensing and contact routes.

Step 1: Create a Workspace

Open the dashboard and create a workspace. A workspace is the container for everything: tests, findings, exploit paths, reports and the team members who can see them.

Use one workspace per client or per engagement. That keeps data isolation meaningful — findings from one target never leak into another team's scope — and it makes the report at the end a single export instead of a filtering exercise.

Personal workspaces are for solo research. Team workspaces add members with owner, admin, member or viewer roles.

Step 2: Choose the Entry Point

WormGPT AI accepts work three ways:

• Paste code into the editor when you already suspect a specific function.
• Upload a module or archive when you want a file-level or repository-level pass.
• Point at a repository when the goal is broad discovery across many languages.

For a first session, paste 200 to 500 lines around the code you care about. Full repositories are better for the pipeline, but a tight, well-chosen snippet teaches you how the tool reasons before you commit hours of analysis.

Step 3: Let the Pipeline Rank

The pipeline does not analyse every file equally. It ranks files by vulnerability likelihood — reachability from untrusted input, dangerous sink usage, recent churn, language-level risk — and sends specialist agents to the highest-risk files first.

Read that ranking before reading any finding. If the top-ranked file is not what you expected, you have learned something about the target: either the tool found an entry point you underestimated, or your snippet is missing context. Both are useful.

Step 4: Read Findings Like a Researcher

Each confirmed finding arrives with a vulnerability class, severity, CWE and CVSS 4.0 score, the source-to-sink trace, a hypothesis, and a proof-of-concept. Read them in this order:

1. The trace. Does untrusted data really reach the dangerous function without sanitisation?
2. The prerequisites. Authentication needed? A specific configuration? A feature flag?
3. The PoC. Run it in the sandbox. A payload that fails is a finding to downgrade.
4. The impact statement. Convert "SQL injection in report export" into "any authenticated analyst can read the customers table".

Anything you disagree with, mark it and note why. The validation pass exists to cut false positives, but the researcher's judgement wins.

Step 5: Move to Exploit Paths

Once findings are confirmed, generate exploit paths. Each path shows the entry point, the steps, the payload, and the MITRE technique it maps to. These are what you show a client who asks "and then what?" — the difference between a list of bugs and an attack narrative.

Step 6: Close the Loop With a Fix

Every finding can return a patch with a test that fails before and passes after. Review the patch rather than committing it blindly: generated fixes are usually correct at the pattern level and occasionally wrong at the design level.

Step 7: Export

Export the workspace to Markdown or JSON when the engagement ends. Structured output goes into tickets; the narrative export goes into the client report.

Key Takeaways

• One workspace per client or engagement keeps isolation meaningful and reporting simple.
• Start with a narrow hunting question and a 200-500 line snippet, not a whole repository.
• Read the file ranking before the findings — it tells you what the tool believes about the target.
• Verify every PoC in the sandbox before you report it.
• Exploit paths turn a bug list into an attack narrative; patches close the loop.

FAQ

How long does a first session take? Budget 30 to 45 minutes: ten to set up the workspace and paste a snippet, twenty to review findings, the rest for exploit paths and export.

Do I need to know how the AI works? No, but understanding the pipeline — ranking, agent analysis, validation — helps you write better prompts and trust results appropriately.

Can I run several targets at once? Yes, in separate workspaces. Parallel analysis runs are independent, and findings never cross workspaces.

What if I disagree with a finding? Mark it and record why. Downstream reports and exports respect your triage decision, and your notes become part of the audit trail.