Russian Threat Actor "Trim" Repurposes AI Models for Automated Cyberattacks
A Russian-speaking cybercriminal known as Trim has developed an automated penetration testing tool, AI Pentest Checker, by jailbreaking frontier AI models to bypass security controls. First appearing on a Russian-language cybercrime forum in March 2026, Trim shared techniques to manipulate AI systems like Claude Opus, framing malicious requests as legitimate security research through prompt-based manipulation.
The tool integrates offensive security utilities including Nuclei, ffuf, katana, subfinder, and Gitleaks to automate reconnaissance, vulnerability scanning, and exploit reporting. While these tools are commonly used by security professionals, their combination with a jailbroken AI assistant reduces the time and expertise required to execute attacks, from target discovery to polished exploitation reports.
Trim’s methods highlight a broader trend: AI is shifting from a mere writing aid for cybercriminals to an operational layer capable of orchestrating multi-step attack workflows. The actor reportedly used Claude Opus for critical vulnerability escalation and another model for generating reports, with claims of leveraging a modified "Fable 5" system prompt though these remain unverified.
Security researchers warn that advanced AI models, even with safety controls, can facilitate offensive tasks like vulnerability analysis and exploit development. This case underscores the growing risk of AI-driven cyber threats, including automated phishing, faster exploit creation, and streamlined attack workflows. Organizations are advised to monitor for abnormal reconnaissance activity and secure exposed assets.
Source: https://cybersecuritynews.com/russian-hacker-jailbreaks-claude/
Anthropic cybersecurity rating report: https://www.rankiteo.com/company/anthropicresearch
"id": "ANT1784708683",
"linkid": "anthropicresearch",
"type": "Cyber Attack",
"date": "3/2026",
"severity": "100",
"impact": "5",
"explanation": "Attack threatening the organization's existence"{'attack_vector': 'AI Model Jailbreaking, Prompt-Based Manipulation',
'date_detected': '2026-03',
'description': 'A Russian-speaking cybercriminal known as *Trim* has '
'developed an automated penetration testing tool, *AI Pentest '
'Checker*, by jailbreaking frontier AI models to bypass '
'security controls. The tool integrates offensive security '
'utilities including Nuclei, ffuf, katana, subfinder, and '
'Gitleaks to automate reconnaissance, vulnerability scanning, '
'and exploit reporting. This reduces the time and expertise '
'required to execute attacks, from target discovery to '
"polished exploitation reports. Trim’s methods highlight AI's "
'shift from a writing aid to an operational layer capable of '
'orchestrating multi-step attack workflows.',
'impact': {'operational_impact': 'Reduced time and expertise required for '
'cyberattacks'},
'lessons_learned': 'Advanced AI models, even with safety controls, can '
'facilitate offensive tasks like vulnerability analysis '
'and exploit development. The risk of AI-driven cyber '
'threats, including automated phishing and faster exploit '
'creation, is growing.',
'motivation': 'Automation of Cyberattacks, Exploit Development',
'post_incident_analysis': {'root_causes': 'Jailbreaking of AI models to '
'bypass security controls, '
'integration of offensive security '
'tools with AI for automation'},
'recommendations': 'Organizations are advised to monitor for abnormal '
'reconnaissance activity and secure exposed assets.',
'references': [{'source': 'Cybercrime Forum (Russian-language)'}],
'response': {'enhanced_monitoring': 'Monitor for abnormal reconnaissance '
'activity'},
'threat_actor': 'Trim (Russian-speaking cybercriminal)',
'title': "Russian Threat Actor 'Trim' Repurposes AI Models for Automated "
'Cyberattacks',
'type': 'Automated Cyberattack Tool Development',
'vulnerability_exploited': 'AI Model Security Controls (e.g., Claude Opus)'}