The Pulling of Mythos Offline: Why AI KYC Will Fail to Stop Cybercriminals

The sudden U.S. government export controls pulling Fable 5 and Mythos 5 offline are already driving a significant surge in the cybercrime underground. To comply with these new restrictions on foreign access, frontier AI labs are expected to implement financial-grade Know Your Customer (KYC) identity verification.

This regulatory shift creates an immediate, highly profitable monetization vector for darknet vendors. Threat actors have spent years refining methods to bypass bank-level identity checks using synthetic identities and mule accounts, and they are already adapting these frameworks to target AI platforms. The cryptocurrency ecosystem serves as a direct and undeniable precedent for this failure. For years, crypto exchanges have attempted to gatekeep access using strict KYC and AML procedures, only to face relentless circumvention from dedicated cybercriminal operations.

A common bypass method relies entirely on existing infostealer malware infrastructure. Compromised logs from infostealers like Lumma, Vidar, and RedLine regularly capture active session tokens, cookies, and saved credentials for vital infrastructure platforms, including Claude.ai and OpenAI. An adversary in a restricted jurisdiction can purchase these stolen logs from underground shops for nominal fees. Importing these valid cookies allows them to hijack a legitimate user’s active session, entirely evading the platform’s onboarding, KYC, and multifactor authentication checks.

Beyond session hijacking via infostealer infections, the darknet already hosts a mature, structured market for pre-verified accounts and identity manipulation services. Threat actors actively trade bypassed accounts on dedicated cybercrime forums, treating access to restricted models as a standard, highly liquid commodity. Initial access brokers simply create the accounts using illicit methods and sell the login details to buyers globally.

When basic mule accounts are insufficient, cybercriminals turn to advanced synthetic identity fraud. The underground economy offers specialized services for deepfake generation and real-time voice manipulation specifically engineered to defeat biometric liveness checks – the very checks frontier AI labs will rely upon to enforce border restrictions.

Coupled with the widespread availability of stolen passports, driver’s licenses, and government identification documents, bad actors possess a complete, inexpensive toolkit to fabricate verified identities on demand. The infrastructure to bypass these impending AI restrictions is already built, tested, and highly profitable.

Mandating identity verification forces AI research organizations to collect and store massive volumes of sensitive personal documentation, including passports and biometrics. These databases represent high-value targets for network intrusions. When these repositories are inevitably breached, the stolen data will be funneled directly back into the cybercrime ecosystem, providing the exact credentials needed to fuel further identity fraud and access bypasses.