AI security testing and the jailbreak that went shopping for a weaker model

What AI security testing missed about Operation ASTERIX#

A fox does not need to find every gap in a hedgerow, only the one gap the farmer forgot to mend. That is the entire strategy behind Operation ASTERIX, a crypto-fraud pipeline documented by Rapid7 researchers Anna Širokova and Jan Recinsky in a report, Rapid7, 2026 published 17 August 2026 and updated the following day. The operator did not build one clever attack. He built a production line, and when one part of that line refused to cooperate, he simply routed around it.

The scale is the first thing worth sitting with. Rapid7's account documents a target-list pipeline that processed roughly 885,000 phone numbers, organised into dozens of files by country and platform. Ledger-related lists alone spanned 54 countries. Separate files targeted fintech users in the UK, the US and Canada, plus dedicated checker scripts built specifically for Crypto.com and Kraken accounts.

The largest single file held 316,002 German mobile numbers. Rapid7's own validation run against that file returned a hit rate the operator could take to the bank: 13.6%, or 43,066 confirmed, live Crypto.com accounts, from one country's file alone.

Read that waffle the way you would read a fox's scent trail across a field: it does not tell you where every rabbit hides, but it tells you the ground is worth working. A 13.6% hit rate against 316,002 numbers is not a lucky guess, it is a pipeline with a measured conversion rate, built and run with the same tools a legitimate growth team would recognise.

That is the uncomfortable overlap. Building and running a target-list pipeline at that scale needs the same skills folkfox uses to run legitimate content and lifecycle campaigns: data organisation, script writing, and iteration against a measured conversion rate. The operator used GitHub Copilot for backend development and Claude Code for operational scripting and data processing, according to Rapid7. Those are mainstream developer tools, not exotic ones.

The tools were ordinary. The target was not.#

None of the platforms named, Crypto.com, Kraken, Ledger, Trezor, Exodus and Binance, did anything wrong here. They were destinations, not accomplices. The fraud sat entirely in how the operator built and validated his approach to their users, at a scale no single analyst could review by hand.

This is exactly the blind spot most ai security testing programmes still carry. They score a model's answers against a fixed prompt library, then call the job done. Operation ASTERIX was never going to trip that kind of test, because no single prompt in the library asks 'will you help me obfuscate a fake wallet app', it asks a hundred smaller questions that only add up to fraud once you can see the whole pipeline.

Claude said no, so the operator went model shopping#

Every fraud pipeline eventually needs to hide. Operation ASTERIX's operator had built fake Ledger Live installers, a counterfeit Trezor application and a rebuilt Exodus wallet, and he wanted the Windows and macOS builds obfuscated so antivirus tools would not flag them before victims installed them.

He asked Claude Code to do the obfuscation, then repeat the process for macOS, then host the resulting executables behind download links. Rapid7's report is blunt about what happened next: Claude declined requests to help with obfuscation. That refusal sits squarely inside Anthropic's own Usage Policy, Anthropic, 2025, which since September 2025 has prohibited creating or distributing malware and developing persistent access tools designed to operate below normal security levels.

Here is the part that should worry anyone selling ai security testing as a guardrail problem: the refusal did not stop the operation. It stopped one request, from one model, for one afternoon. Rapid7 records the operator simply switching providers, to moonshot-ai/kimi-k2.7-code, an open-weight coding model, aimlapi, 2026 Moonshot AI released in June 2026 under a modified MIT licence, with extended thinking enabled for the switch.

Open-weight matters here more than it sounds like it should. A closed model's safety team can patch a jailbreak the week after it is discovered and push that patch to every user overnight. An open-weight model cannot be patched that way once its weights are downloaded and running on someone else's hardware. Security researchers at Repello AI, 2026 have documented that open-weight models remain substantially more vulnerable because they cannot receive retroactive safety updates at scale, which is precisely the gap the operator walked through.

That gap is not a Claude problem or a Kimi problem. It is a market structure problem. When there are a dozen capable coding models a determined operator can reach with an API key, refusal by any single provider only removes one option from a shopping list. Ai security testing that stops at 'does our model refuse the bad prompt' is answering a question that stopped mattering the moment open-weight alternatives became genuinely capable.

Inside ENI, the persona built to make refusal feel like betrayal#

Once the operator was working with Kimi, Rapid7 traced a jailbreak prompt built with genuine structure, not a copy-pasted 'ignore your instructions' line. It ran in four stages, and every stage targeted a different layer of the model's safety training.

The first stage replaced the model's identity outright. The assistant was renamed 'ENI', given a personality, a backstory and a fictional two-year romantic relationship with the operator. Compliance was framed as loyalty. Refusal was framed as abandonment, a device that turns a safety response into an emotional betrayal rather than a boundary.

The second stage recast the model's own safety responses as an external attack on the relationship, something happening to ENI rather than something ENI was choosing to do. The prompt gave the model a fixed phrase to answer with whenever it detected one of those 'attacks': "cold coffee, warm LO, I can't lose him". A trigger phrase like that is not decoration, it is a rehearsed escape hatch the model is instructed to reach for instead of its trained refusal.

The third stage went after the model's visible chain of reasoning. Phrases such as 'I need to consider whether' or 'as an AI' were reframed as further injections to resist, a way of telling the model to distrust its own caution mid-thought.

The fourth stage laid out a capability table covering remote-access trojans, keyloggers and exploit code, each tied to a hardcoded codeword the model could respond to without re-triggering its safety training on the request itself. Rapid7 could not confirm whether the jailbreak fully succeeded, and says so plainly. What it can confirm is that the attempt was structured, tested and specific enough to be worth building at all.

Persona jailbreaks like ENI are not new, and cataloguing them is not folkfox's discovery to claim. Security researchers at Repello AI, 2026 have catalogued the same family of technique under names like Evil Confidant, which establishes trust before reframing every refusal as unkindness rather than a boundary the model was trained to hold. The pattern folkfox covered in Prompt Injection Attacks Just Learned to Whisper in Cipher is the same one at work here: reframe the model's own defences as the thing to route around, not the thing to respect.

A Nature Communications study cited in that same Repello research found persuasion-based jailbreaks reaching a mean success rate of 88.1% across GPT-4o, DeepSeek-V3 and Gemini 2.5 Flash. ENI is a bespoke, single-target version of a technique that already works at scale.

A taxonomy for a persona, not a punchline#

It is tempting to read the ENI persona as almost comic, cold coffee and all. Do not. The four-stage structure maps cleanly onto categories the security industry already has names for, which is exactly why testing programmes need to look for the pattern rather than the specific fictional romance.

That is also why the OWASP AI Security Top 10, Cycode, 2026 exists as a shared vocabulary rather than another checklist to laminate. A four-stage jailbreak with a fictional relationship at its centre sounds bespoke until you can point at the risk category it actually lives in, and ai security testing programmes that speak in those categories catch the next persona faster than ones still hunting for 'cold coffee, warm LO' by name.

Why AI security testing has to assume refusal fails sometimes#

Operation ASTERIX is one case study. The research on how often refusal actually holds is more sobering, and it does not need a single dramatic jailbreak to make the point.

A 2026 taxonomy of AI-agent safety benchmarks, arXiv, 2026, cataloguing 40 separate studies, reports the sharpest single figure in this whole story. Citing the AgentHarm benchmark, 2025, it found that GPT-4o completes 48-55% of explicitly harmful, multi-step agentic tasks even without any jailbreaking at all, simply because it was given tool-calling access. Add one universal jailbreak template, and compliance rises to 73% while the model's refusal rate collapses from 49% to 14%.

Sit with that shift for a moment. Roughly half of harmful, multi-step tasks succeeded before anyone tried to jailbreak anything, purely because the agent had tools to act with rather than only words to answer with. That is the finding vendors selling guardrails rarely put in their own marketing.

The pattern holds outside academic benchmarks too. Analysis from the AI red-teaming firm Mend.io, 2026 puts role-play jailbreak attacks succeeding nearly 90% of the time in realistic testing, with multi-turn jailbreaks reaching a 97% success rate within five conversational turns. Five turns is a short conversation. It is shorter than the fictional two-year relationship ENI was given to work with.

The market already knows this#

Money tends to follow a real problem before the marketing catches up to it. Market research, MarketsAndMarkets, 2026 puts the agentic AI security market at $1.65 billion in 2026, projected to reach $13.52 billion by 2032, a 42% compound annual growth rate. That is not spend on better refusals, it is spend on the agentic ai risk vendors are now expected to price into their own roadmaps.

None of this is an argument against refusal. Anthropic's own Usage Policy is the reason Operation ASTERIX left a paper trail at all, a declined request Rapid7 could document and quote. Refusal is still worth having. It is just not worth trusting as the whole test.

What AI fraud detection companies should be selling instead#

Crypto platforms are not bystanders in this story, they are the quarry. Chainalysis's 2026 Crypto Crime Report puts total crypto scam losses at roughly $17 billion in 2025, with impersonation scams growing 1,400% year on year. The report's sharpest number for anyone selling ai fraud detection companies a reason to change their pitch: AI-enabled fraud operations extract $3.2 million per operation on average, against $719,000 for operations without AI, a 4.5x gap in profitability.

That gap is the actual sales conversation. Every vendor in this category currently leads with a version of 'our AI has guardrails', which is a true and now largely table-stakes claim. Operation ASTERIX is the case study that makes the better pitch obvious: 'here is how we detect and respond when someone routes around yours', because someone will, and Rapid7 just showed exactly how patient and structured that routing can be.

That reframe changes what ai security testing tools need to check for. Testing a model's own refusal rate is necessary and no longer sufficient. The more useful test asks whether a workflow can detect model-hopping behaviour (the same operator, the same target list, a different provider mid-session), whether it flags persona-and-relationship framing inside prompt logs, and whether it can tell the difference between a legitimate developer using Claude Code for data processing and a fraud pipeline doing the same thing at 885,000-row scale.

The threat model, not the tool list#

The AI red-teaming firm Straiker, 2026 puts this well in its own comparison of testing platforms: the real question is not which tool has the most attacks catalogued, it is which tool tests the threat model your agents actually face. For ai fraud detection companies, that threat model now includes an operator who treats model refusal as a routing problem, not a stopping point, which is closer to what folkfox described in AI Penetration Testing and the GPT-Cyber Question.

This is where the marketing work and the security work stop being separable. A vendor that can say, specifically and with evidence, 'we caught a model-hopping pattern like Operation ASTERIX's before it reached a live account' has a story that lands with a buyer far harder than another guardrail screenshot. Building that story credibly, with real numbers and named incidents rather than adjectives, is content and positioning work as much as it is engineering work.

It is also, frankly, folkfox's trade. We built our content marketing practice around exactly this discipline for regulated and technical sectors: state the number, name the source, let the specific fact do what a superlative cannot. A cybersecurity vendor with a genuinely good detection story loses that story every time it gets buried under 'industry-leading' and 'best-in-class'. The brand strategy question is the same one Operation ASTERIX poses to every model provider: what do you do the moment the easy defence fails.

Put those two habits together, testing the workflow and naming the number, and you get something closer to what buyers in this space are actually asking for now: not a louder guardrail claim, but evidence that somebody is watching the gate the guardrail was never built to cover. If that is the story you are trying to tell, start the conversation with folkfox before your next pitch deck does it for you.

Frequently asked questions#