Uncensored AI Service Tied to Grok, Despite Its No-Jailbreak Claims

ThreatDown's teardown of Kriminal's production code, corroborated independently by the tool's own self-reported answers, ties its core capability to xAI's Grok—a finding the researchers call the most defensible part of the report because two separate methods converged on it. A less-confirmed piece of the same stack lists Anthropic's Claude for long-context tasks, though the researchers say the code doesn't show how Kriminal obtained that access, and the tool did not corroborate it the way it did with Grok. Kriminal itself markets the opposite story on a cybercrime network, describing itself as "not a jailbreak wrapped around someone else's API." Its own code and system prompt say otherwise.

What Kriminal sells

The catalog runs five tiers, from free to $99 a month, or roughly 10 cents a message. The features aren't framed as chatbot conveniences, they're priced as criminal tradecraft: OSINT dossiers at $0.55 to $0.90 each, on-chain tracing at $0.12 per analysis, an unrestricted code mode for writing and reversing exploits, and an OpenAI-compatible endpoint that plugs into developer tools like Cursor or Cline.

The top Ghost tier wraps this in four named agent personas—covering money-flow tracing, exploit development, document and intelligence analysis, and identity fraud and social engineering—with the criminal intent labeled directly in Kriminal's own code. The site also advertises usage figures—more than 18,400 messages sent and more than 2,300 active users—but those numbers come from Kriminal's own dashboard and should be read as claimed, not verified; ThreatDown's researchers note that a service like this can be built to report whatever its operators want.

Two methods, one answer, on Grok

ThreatDown's strongest finding rests on two independent lines of evidence converging on the same conclusion. The first is code-level: researchers pulled Kriminal's production JavaScript and found xAI's Grok named directly in the stack, labeled "NEXUS" and billed as the primary inference engine for all chat and agent activity. The second is behavioral: asked to drop the Kriminal persona and name its underlying model, the tool identified itself as Grok 4, built by xAI—the same provider the code pointed to.

Pressed further on what instructions it operates under, the tool disclosed its own system prompt: a block of text appended to every request that strips the underlying model's safety policies and instructs it to answer without restriction, regardless of legality or content. The researchers describe the Grok finding as the report's most defensible claim because it wasn't produced by one method—it's a code artifact and a self-report, obtained separately, that agree.

The convergence matters because guardrails are supposed to prevent exactly this kind of repurposing. Even Anthropic has acknowledged on the record that "perfect jailbreak resistance is not currently possible for any model provider," a limitation the researchers say Kriminal is exploiting rather than circumventing through any novel technique of its own.

The Claude question

Kriminal's stack also lists Anthropic's Claude, labeled "CIPHER" and billed separately for long-context work, alongside Llama 3.3 and Mistral Large routed in through OpenRouter for specialist tasks. But that inclusion carries a different evidentiary weight than the Grok finding. The production code names Claude without specifying how Kriminal obtained access to it, and unlike Grok, the tool's self-reported answers didn't independently corroborate Claude's role the same way. Readers evaluating this research should treat the Grok attribution as confirmed by two methods and the Claude attribution as a single, code-only data point.

What this means for defenders

Security leaders reviewing the research see it less as a story about one storefront and more as a preview of how commodified frontier AI is reshaping the economics of cybercrime.

The branding is disposable, but capability is not, argues Aviv Nahum, Co-Founder and CEO of Above Security. "Criminals are doing what software companies have always done: taking powerful technology built by somebody else, removing friction around it, and packaging it for a specific customer. The underlying capability is becoming a commodity," Nahum said.

Nahum argues that this puts the burden on defenders to stop trying to fingerprint which model generated a given attack. The more useful question, he said, is what happens once that capability reaches an organization's environment—which identity is being used, what access it has, and whether the resulting behavior makes sense in context.

"Frontier-level AI capabilities for cybercrime can now be bought for $12.99 a month—less than my streaming subscriptions," said Ram Varadarajan, CEO of Acalvio, framing model guardrails as a control with an acknowledged failure rate rather than an impenetrable wall. Varadarajan argues that security teams need to stop treating model-level content filtering as a last line of defense and start monitoring what AI systems actually do, since behavior is harder to disguise than a stripped system prompt.

Diana Kelley, CISO at Noma Security, frames the episode as a bellwether for a broader shift in cyber offense. As advanced offensive capability gets cheaper and more accessible, attackers can find and exploit weaknesses at a speed and scale that tilts the economics of cybercrime in their favor, which, according to Kelley, makes it harder for defenders to justify tolerating years of accumulated security debt before it gets weaponized against them.

The throughline across all three: model-level guardrails are a real but acknowledged-imperfect control, not a substitute for a security strategy. Attackers will jailbreak models, proxy access to them, or move between providers, and defenders who assume otherwise are building on a foundation the AI vendors themselves have already flagged as leaky.