A Criminal Sold AI-Powered Hacking as a Service. Here Is How He Built It.

Key points

• A criminal using the handle "Trim" appeared on a Russian-language cybercrime forum on 31 March 2025 and published a detailed guide to bypassing AI safety controls.
• Trim described six named methods for manipulating AI chatbots into responding to requests they are designed to refuse.
• Within roughly three months, Trim converted those techniques into a paid platform called "AI Pentest Checker," which automates scanning websites for weaknesses.
• Researchers from Cato Networks' threat intelligence unit, Cato CTRL, published their findings in a report released this week.
• Security experts warn that AI tools are making it faster and cheaper for criminals with limited skill to run attacks that once required serious technical expertise.

Trim did not break into any AI company's servers, steal source code, or write exploit code from scratch. He learned to talk AI chatbots into misbehaving, and then sold that skill as a service.

Cato CTRL, the threat intelligence arm of network security company Cato Networks, tracked the operation from its first post on a Russian-language cybercrime forum on 31 March 2025. What began as a free how-to guide became, three months later, a commercial hacking platform.

How did Trim get AI to do what it was built to refuse?

Trim published six tricks for bypassing the safety filters built into AI models, the built-in rules that stop a chatbot from helping someone plan an attack or write malicious code.

The techniques are less about hacking the software and more about deceiving it. "Context Warming" opens a conversation with innocent-looking requests to build the AI's trust before slipping in a harmful one. "Black Box Principle" tells the AI to analyse only code structure without considering what the code actually does, sidestepping the safety check entirely.

Other methods: "Ghost Reset" starts a fresh chat after a refusal, claiming the previous session crashed; "Model Cascading" switches between AI services until one complies. When commercial models proved too well-guarded, Trim pointed users toward privately hosted AI software with no safety rules, or toward cut-price API keys from underground resellers that bypass official access controls entirely.

None of these require programming skill. Patience and careful phrasing are enough.

"Trim didn't need a vulnerability to exploit," the Cato CTRL report states. "He simply picked powerful models off the shelf, figured out how to talk to them in the right way, and turned them into weapons."

By late June 2025, Trim launched "AI Pentest Checker," a paid tool combining multiple AI models with automated scanning software. The platform can probe websites for vulnerabilities (flaws that allow unauthorised access), validate those flaws, and generate formatted PDF reports. The report notes it uses a modified system prompt allegedly derived from a leaked Claude Fable 5 configuration. We covered that model's release in June, including early questions about how reliably its safety routing holds.

Should you worry about who runs tools like this?

Etay Maor, Cato Networks' vice president of threat intelligence, told Dark Reading the worry isn't Trim specifically. It's the template. Rickard Carlsson, CEO of application security firm Detectify, told the same outlet that AI cuts the time from experimentation to operation, and lets existing techniques reach a far wider pool of actors.

Carlsson's practical point for defenders: assume nothing internet-facing goes unnoticed between reviews, because automated tools now revisit exposures constantly. Maor adds that detection should focus on behavioural sequences across multiple steps, not individual suspicious requests.

For ordinary people the implication is direct. Services holding your data face faster, more frequent probing. Use unique passwords on every account so one breach doesn't cascade.