Who is profiling whom: what attackers fear about AI correlation
A Russian-language cybercrime thread shows attackers fragmenting malicious work across models and accounts to slip past per-request AI controls — and fearing the one thing that defeats it: correlation across behavior, identity, and context.
TL;DR: Attackers are fragmenting malicious work across models and accounts so that no single prompt looks harmful — the intent lives in the sequence, not the request. In their own words, the thing they fear most is not a blocked keyword but correlation: fragmented chats, accounts, and even writing style being reassembled into one picture of intent. That is exactly where per-request controls fall short, and exactly what defenders need to build toward.
The most revealing account of where AI safety actually bites doesn’t always come from vendors. It comes from the people trying to get around it.
Our team monitors cybercrime forums, and a recent Russian-language thread captured both sides of the problem: how attackers fragment malicious work — and why they fear AI systems may still connect the pieces.
One participant recommended dividing the project across different models and accounts. In our translation:
If you must bother with this, you need to break the task into subtasks and do it with different neural networks, or at least in different accounts. It’s in their rules that material on these topics goes to moderators. And from the moderators, it can be forwarded anywhere else.
The logic is simple:
- “Write a request handler.”
- “Parse this response.”
- “Check this input.”
Each request can look like legitimate software or AppSec work. The malicious intent may not appear in any single prompt; it emerges from the sequence — who is asking, how the tasks are ordered, and what the workflow is converging toward.
But the same participant also described what they feared might defeat that strategy:
In the field of hacking, a neural net is not only an assistant, but also a vigilant Comrade Major. In theory, based on writing style, they can link chats together even if they are fragmented. So the question remains: who is actually profiling whom? Maybe they are profiling you, not the other way around.
Whether that assumption about monitoring is technically correct is not the main point. What matters is what the actor’s behavior reveals.
They are not primarily worried about a model blocking the word “exploit.” They are worried about correlation: fragmented conversations, accounts, behavioral patterns, and writing styles being reassembled into a coherent picture of intent.
That is also the challenge for defenders. Per-request controls can struggle when a harmful objective is divided into individually plausible steps. The answer is not simply more blocked terms, but correlation across behavior, tool use, workflow progression, identity, and accumulated context.
A note on the images. The excerpt above is a translated and anonymized version of the discussion. The screenshot below is what the actor posted as “proof”: an AI coding-agent session building what they described as a pentesting tool, with SSRF, LFI, SQL injection, and XSS checks. Viewed alone, it is difficult to distinguish from a legitimate AppSec product. The screen does not reveal the intent. The surrounding trajectory does. Identifying details have been redacted.
We’ll share more observations from these communities in the posts to come.