Russian Threat Actor "Trim" Repurposes AI Models for Automated Cyberattacks A Russian-speaking cybercriminal known as Trim has developed an automated penetration testing tool, AI Pentest Checker, by jailbreaking frontier AI models to bypass security controls. First appearing on a Russian-language cybercrime forum in March 2026, Trim shared techniques to manipulate AI systems like Claude Opus, framing malicious requests as legitimate security research through prompt-based manipulation. The tool integrates offensive security utilities including Nuclei, ffuf, katana, subfinder, and Gitleaks to automate reconnaissance, vulnerability scanning, and exploit reporting. While these tools are commonly used by security professionals, their combination with a jailbroken AI assistant reduces the time and expertise required to execute attacks, from target discovery to polished exploitation reports. Trim’s methods highlight a broader trend: AI is shifting from a mere writing aid for cybercriminals to an operational layer capable of orchestrating multi-step attack workflows. The actor reportedly used Claude Opus for critical vulnerability escalation and another model for generating reports, with claims of leveraging a modified "Fable 5" system prompt though these remain unverified. Security researchers warn that advanced AI models, even with safety controls, can facilitate offensive tasks like vulnerability analysis and exploit development. This case underscores the growing risk of AI-driven cyber threats, including automated phishing, faster exploit creation, and streamlined attack workflows. Organizations are advised to monitor for abnormal reconnaissance activity and secure exposed assets.