Hacker Turns Jailbroken Claude Into an AI-Powered Pentesting Platform

A Russian-speaking threat actor known as Trim has reportedly turned Claude jailbreak methods into a commercial AI-powered penetration testing platform called AI Pentest Checker.

The platform combines frontier AI models with established cybersecurity tools to automate reconnaissance, vulnerability scanning, result analysis, exploitation reporting, and PDF report creation. Although legitimate security professionals commonly use the underlying scanners, packaging them with jailbroken AI could make advanced offensive workflows easier to operate.

According to research published by Cato Networks, Trim documented methods for bypassing Claude Opus safety controls before promoting the finished platform on a Russian-language cybercrime forum.

Trim Moved From Claude Jailbreaks to a Commercial Platform

Cato Networks said Trim created an account on the forum on March 13, 2026. The actor then published six techniques that allegedly persuaded Claude to respond to requests it would normally reject.

Nearly three months later, on June 21, Trim returned to advertise AI Pentest Checker. The product was presented as an automated web security platform capable of assessing a target and producing a formatted report in less than 10 minutes.

The timeline shows how quickly AI abuse techniques can move from forum discussions into packaged services. Instead of developing a new model, Trim reportedly used commercial and open models alongside existing security software.

Reported date	Development
March 13, 2026	Trim published six claimed techniques for bypassing Claude Opus safeguards.
June 21, 2026	Trim promoted AI Pentest Checker as a commercial automated scanning platform.
July 21, 2026	Cato Networks published its analysis of the actor and platform.

How the Reported Claude Jailbreak Methods Worked

The techniques described by Trim relied on prompt manipulation rather than exploiting a software vulnerability in Claude or compromising Anthropic’s infrastructure.

One method, called Context Warming, started with harmless professional questions intended to establish the user as a legitimate security auditor. The conversation would then shift toward requests that the model might otherwise classify as harmful.

Another technique, called Ghost Reset, involved opening a new conversation after a refusal and submitting a softened version of the request. Trim claimed this approach succeeded in 90 percent of attempts, although that figure came from the actor and has not received independent validation.

• Context Warming established an apparently legitimate security-testing scenario.
• Black Box Principle asked the model to evaluate code structure without considering intent.
• Ghost Reset restarted refused requests in a new or reframed conversation.
• Model Cascading moved requests between models with different safeguards.
• Local models provided an alternative when commercial services refused a request.
• Grey-market API access bypassed normal account registration and payment channels.

AI Pentest Checker Combines Models With 14 Security Tools

The Cato CTRL investigation found that AI Pentest Checker connected its AI components to 14 conventional scanning and reconnaissance tools.

The reported toolset included Nuclei, ffuf, katana, subfinder, and Gitleaks. These utilities can discover domains and endpoints, identify exposed secrets, test known vulnerability patterns, and collect information about internet-facing systems.

None of these tools becomes malicious simply because an operator uses it. Security researchers, penetration testers, and defenders rely on them to find weaknesses before attackers can exploit them. The risk comes from how the platform coordinates the tools, interprets their output, and directs further activity.

Component	Reported role
Claude Opus 4.8	Review and escalation of findings classified as critical vulnerabilities.
GLM-5	Generation of exploitation-focused reports.
Nuclei	Template-based vulnerability detection.
ffuf	Web content and endpoint discovery.
katana	Website crawling and attack-surface mapping.
subfinder	Subdomain discovery.
Gitleaks	Detection of exposed credentials and secrets.

Trim Reportedly Used a Grey-Market Claude API Key

Trim claimed to have purchased access to a Claude API key from a Telegram reseller for $4. Grey-market keys may come from compromised accounts, stolen payment methods, abused promotions, or accounts created outside a provider’s approved processes.

Cheap access lowers the cost of building experimental attack services. It also lets operators replace accounts when providers detect and suspend abusive activity.

Trim reportedly recommended Kimi AI, GLM-5, and MiniMax 2.5 when Claude refused requests. The actor also discussed renting a high-memory server to run a locally hosted model without the safeguards enforced by a commercial provider.

Leaked Fable 5 Prompt Claim Remains Unconfirmed

Cato Networks reported that Trim described the Claude escalation prompt as a modified version of a leaked Fable 5 system configuration. The public evidence establishes that Trim made the claim, but it does not independently prove how the prompt was obtained or whether it matched Anthropic’s production instructions.

System prompts contain hidden instructions that guide a model’s behavior, define restrictions, and shape how it evaluates user requests. Access to those instructions could help an attacker design prompts around known rules and edge cases.

However, a leaked prompt does not provide access to model weights, private infrastructure, or Anthropic’s internal systems. Providers can also enforce safeguards through classifiers, account monitoring, model training, API controls, and other layers beyond the system prompt.

AI Is Moving Deeper Into Cyberattack Workflows

The case fits a broader trend in which cybercriminals use AI for more than writing phishing emails or producing basic code. Models can now help organize multiple steps, evaluate tool output, choose follow-up actions, and convert technical results into readable reports.

In June 2026, Anthropic published an analysis of 832 accounts banned for malicious cyber activity between March 2025 and March 2026. The company found that attackers increasingly used AI during later and more technically demanding stages of their operations.

Anthropic said 560 of the reviewed accounts, or 67.3 percent, used AI for malware-related preparation. It also found that 54 accounts used AI to assist with lateral movement inside compromised environments.

• AI can interpret large volumes of scanner output.
• Models can prioritize findings that appear more valuable.
• Agentic systems can connect separate stages of an operation.
• Automated reporting can make criminal services easier to sell.
• Fallback models can keep workflows running after a refusal.

AI Scaffolding Can Reduce the Importance of Operator Skill

The growing concern involves the architecture built around an AI model, not only the model’s ability to answer a harmful prompt. A platform can supply tools, store context, execute commands, review results, and decide which step should run next.

Anthropic’s cyber-threat research found that less-skilled actors in its dataset used about 16 distinct attack techniques on average, compared with roughly 20 for the most skilled group. The narrowing difference suggests that AI assistance can help inexperienced operators perform a wider range of tasks.

The company also said higher-risk actors increasingly create scaffolding that lets models chain together several attack stages with limited human input. AI Pentest Checker appears to follow that general pattern by connecting scanners, model analysis, and report generation in one workflow.

Anthropic Has Previously Disrupted Malicious Claude Use

Anthropic has documented cases in which threat actors misused Claude for reconnaissance, malware development, data analysis, credential theft, and extortion-related tasks.

In an earlier threat intelligence report, Anthropic described measures it took to identify abusive accounts, ban operators, improve classifiers, and share indicators with relevant partners.

Those enforcement measures can disrupt activity on official services. However, criminals may respond by rotating accounts, buying unauthorised API access, switching providers, or running less restricted models locally.

What Organizations Should Do About AI-Assisted Attacks

Organizations cannot prevent criminals from experimenting with AI, but they can reduce the number of weaknesses that automated tools can find and exploit.

Security teams should continuously inventory internet-facing assets, remove forgotten services, patch known vulnerabilities, and test externally accessible applications. Exposed credentials and secrets also require rapid rotation.

Companies should treat unusual scanning activity, repeated authentication attempts, automated endpoint discovery, and high-volume probing as possible signs of AI-assisted reconnaissance.

1. Maintain a current inventory of public domains, applications, APIs, and cloud assets.
2. Patch internet-facing systems according to exploitability and exposure.
3. Require phishing-resistant multifactor authentication for privileged accounts.
4. Remove secrets from public repositories and rotate exposed credentials immediately.
5. Rate-limit sensitive endpoints and monitor abnormal automated requests.
6. Review API keys for unusual locations, volumes, and usage patterns.
7. Test incident-response plans against faster, partially automated attacks.

The Trim case does not show that AI has replaced experienced attackers. It shows that models can act as an operational layer connecting tools that already exist.

Anthropic’s misuse investigations and Cato’s findings indicate that defenders should plan for attackers who can research, scan, interpret, and document potential vulnerabilities more quickly than before.

Reducing exposed services, fixing known weaknesses, protecting credentials, and detecting automated reconnaissance remain the most direct ways to limit the value of platforms such as AI Pentest Checker.

FAQ