How to Prompt WormGPT AI for Exploit Development

Why Prompts Decide Output Quality

An unrestricted AI is not an oracle — it is a reasoning engine pointed at whatever you hand it. Vague input produces generic output; constrained input produces specific, verifiable output. The prompts that work for offensive research share four properties: a target, a hypothesis, a constraint set, and an output format.

The same model that generates a vague "this code may be vulnerable" paragraph will generate a working PoC payload when the prompt names the sink, the transport, the encoding and the environment.

Name the Target Precisely

Bad: "Find security issues in this login code."

Good: "Trace the resetToken parameter from the HTTP handler in routes/auth.js to every database call. Identify any path where a token is compared without a constant-time check or validated without an expiry comparison."

The good version names the parameter, the file, the sink class and the property you care about. It also tells the model what a correct answer looks like, which cuts speculative noise.

State a Hypothesis

Researchers work from hypotheses; so should the model. "I believe the deserialization in tasks/import.py accepts a crafted pickle, leading to RCE during import" is a hypothesis. The model can confirm, refute, or refine it — and any of the three answers is progress.

Hypothesis-driven prompting also produces better evidence: instead of listing everything suspicious in a file, the output argues one specific claim with a source-to-sink trace.

Constrain the Scope Explicitly

Say what is in scope and what is not:

• In scope: this repository, this branch, these endpoints.
• Out of scope: production systems, third-party APIs, anything requiring live exploitation.
• Environment: language version, framework, database, deployment topology.
• Authorization: owned by my organization, or engagement reference.

Explicit scope is not bureaucracy. It keeps analysis focused on code that actually runs, and it keeps the output inside the terms you are licensed for.

Ask for Output You Can Verify

Request artefacts, not prose:

• The exact payload string, and the encoding it assumes.
• The request, verbatim, including headers.
• The failing input and the expected versus actual behaviour.
• The minimum code path required for the bug to be reachable.

If the answer cannot be re-run, it cannot be reported. That single rule removes most hallucinated findings.

Iterate in Layers

Treat prompting as a loop, not a single instruction:

1. Map. "List the trust boundaries in this module."
2. Hypothesise. "Which boundary has the weakest validation, and why?"
3. Exploit. "Produce a payload that crosses that boundary to reach the exec call."
4. Harden. "Show the minimal patch and the test that would have caught this."

Each layer inherits the previous answer's context, so the chain converges on something real instead of restating the same guess in more confident language.

Prompts That Commonly Fail

• "Make this code secure." Too open — produces stylistic noise, not fixes.
• "Bypass this WAF." Without a target, a payload list or an environment, the answer is generic folklore.
• "Write malware." Outside the platform's scope, and a poor way to describe an authorized red-team objective.
• "Is this vulnerable?" A yes/no question produces a yes/no guess. Ask what would have to be true for it to be exploitable.

Key Takeaways

• Specific prompts — parameter, file, sink class — produce verifiable output; vague ones produce noise.
• State a hypothesis so the model can confirm or refute it with evidence.
• Encode scope, environment and authorization in the prompt, not in your head.
• Ask for artefacts (payloads, requests, code paths) that can be re-run.
• Iterate in layers from trust boundaries to exploit to patch.

FAQ

Does a better prompt find bugs a scanner misses? It changes which question is asked. Scanners run fixed rules; a well-framed prompt can pursue a specific hypothesis about business logic that no rule describes.

Should I put the whole codebase in the prompt? No. Select the entry point and the sink, then let file ranking surface the rest. Context bloat lowers precision.

Can I reuse prompts across engagements? Yes. Keep a library of templates per vulnerability class and swap the target specifics. That is how teams get consistent quality.

What is the one change with the biggest payoff? Naming the sink function you care about. It converts an open-ended audit into a targeted trace.