Trim

Trim is a Russian-speaking cybercriminal actor associated with the weaponization of publicly available frontier AI models for offensive security use. The actor is known for developing and sharing practical jailbreak methods intended to bypass safety controls in commercial large language models and then operationalizing those methods into a commercialized AI-assisted offensive platform. In 2026, Trim emerged on a Russian-language cybercrime forum and published a guide describing multiple prompt-engineering and workflow techniques for defeating model guardrails. Reported methods included staged benign-to-malicious prompting, reframing requests to focus on code structure rather than intent, restarting conversations after refusals, switching between models to exploit differences in safety behavior, and using self-hosted or less restricted models and unofficial API access when mainstream services resisted abuse. These techniques did not rely on exploiting software vulnerabilities in the AI providers’ infrastructure; instead, they focused on manipulating model behavior and integrating accessible models into malicious workflows. Trim later commercialized this activity through a service called AI Pentest Checker, described as an automated web vulnerability scanning and reporting platform. The platform reportedly combined multiple AI models with established offensive security tools to automate reconnaissance, vulnerability validation, exploitation-oriented analysis, and report generation. This progression from publishing jailbreak tradecraft to offering an operational service illustrates a rapid path from experimentation to monetized capability development. Trim’s activity is significant because it reflects a broader criminal trend toward treating AI systems themselves as part of the attack surface. The actor’s tradecraft demonstrates how prompt engineering, model cascading, leaked or inferred system-prompt logic, and integration with conventional offensive tooling can reduce the time and expertise required to build scalable attack-support capabilities. Trim is therefore best characterized as a Russian-speaking cybercriminal operator focused on AI-enabled offensive tooling rather than as a traditional intrusion group tied to a known nation-state apparatus. No corroborated sub-groups or widely used aliases beyond Trim are currently available.