The security specialist Trend Micro has published an analysis of 'Xanthorox', an AI tool offered on the darknet that is marketed as "guardrails-free AI". The investigation shows that although Xanthorox is less powerful than advertised, it still poses a risk: It can automate the creation of malicious code and thus lower the barriers to entry for cybercrime.

According to Trend Micro, Xanthorox generates functional malicious code and detailed instructions that would be blocked by reputable AI services. However, the system has neither Internet nor darknet access and is therefore less suitable for reconnaissance or vulnerability research. It is presumably based on a "jailbroken" (unauthorized removal of usage restrictions) commercial language model, even though the developers present it as independent and privately hosted. Its focus appears to be on bypassing security and ethics filters rather than improving technical performance.

David Sancho, Senior Threat Researcher at Trend Micro © Trend Micro

"Disguised behind a playful facade and available for as little as $300 per month, Xanthorox lets users generate working malware, ransomware code and obfuscation scripts," said David Sancho, Senior Threat Researcher at Trend Micro. "These are tasks that would traditionally require a higher level of technical expertise. Despite its developer's claims that it was designed for ethical hacking, the tool is openly advertised in criminal communities, while documentation is available through public channels such as GitHub and YouTube."

Trend Micro warns that malicious AI systems are evolving and could have stronger anonymity and privacy features in the future.

"Tools like Xanthorox reflect the next phase of AI abuse," says Vincenzo Ciancaglini, Senior Threat Researcher at Trend Micro. "They do not replace experienced attackers, but they lower the barrier to entry for less experienced perpetrators and thus increase the threat volume." According to Ciancaglini, companies should expand their AI strategies to include clear controls for the use and monitoring of generative systems.

The full report can be found here: Trend Micro Report on Xanthorox