Launched quietly in February, a new torrent search engine called TorrentClaw has rapidly expanded into a massive index comprising more than six million torrent files. Built from the ground up to leverage modern artificial intelligence, the platform aggregates links from its own dedicated Distributed Hash Table (DHT) crawler alongside dozens of external torrent sites and aggregators. In just a few months of operation, its database has ballooned to include major contemporary releases, ranging from the latest Hollywood blockbusters to popular streaming television series.
While traditional torrent indexes often feature clunky, aging interfaces reminiscent of the early internet, TorrentClaw’s homepage immediately stands out with a sleek, contemporary design bearing unmistakable signs of AI-assisted creation. The developers behind the platform—who collectively operate under the pseudonym Deivid Soto—make no secret of this fact. On the contrary, artificial intelligence sits at the very heart of the site’s development, operational framework, and marketing strategy.
According to Soto, the platform is largely built and maintained through automated tools. "Basically, the core framework is Claude Code combined with local LLMs for specific execution and ingestion tasks," Soto explains. Rather than relying on tedious manual labor, the site employs artificial intelligence to intelligently match incoming torrent files to legitimate film and television titles, ensuring that its extensive directory remains neatly categorized. Beyond simple organization, this AI-driven infrastructure enabled the developers to engineer unique proprietary tools designed to tackle persistent issues within the peer-to-peer ecosystem, most notably the prevalence of deceptive files and malicious software.
One of the standout features developed through this approach is TrueSpec, an automated verification system designed to check whether torrent swarms actually contain the media their release titles promise. On the vast majority of torrent platforms, users must rely entirely on release names—which typically list resolutions, audio codecs, and release groups—with no inherent guarantee of accuracy. While well-run, curated communities often employ human moderators to catch mislabeled or harmful content, automated indexes generally lack active moderation, leaving users vulnerable to malicious payloads. TrueSpec was designed to bridge that gap.
TrueSpec: Download and Verify
The mechanics behind TrueSpec rely on direct interaction with the peer-to-peer network. When evaluating a file, the system joins the active torrent swarm, reads the internal file listing, and downloads a minimal fraction of the data—specifically between 10 and 20 megabytes per torrent—allowing it to analyze the underlying video container using the standard media analysis tool ffprobe.
In addition to verifying that video containers match their text descriptions, TrueSpec evaluates suspicious files by querying their cryptographic hashes against VirusTotal. When files are small enough, the system automatically uploads them to the security platform for a comprehensive scan. TorrentClaw does not operate its own proprietary virus scanning software; instead, all malware verdicts are sourced directly from VirusTotal’s established threat intelligence database.
When TrueSpec successfully identifies a confirmed malicious payload, the corresponding torrent is not outright purged from the index. Instead, it remains listed on the site, accompanied by a clear "Malware detected" label, while its download functionality is disabled. Demonstrating the persistence of these threats on the wider web, the developers noted that even after being flagged, a fake episode of the popular anime series Jujutsu Kaisen retained 34 active seeders while continuing to remain accessible across various external torrent sites.
Not Perfect
Despite its innovative approach to automated safety, the TrueSpec system has faced teething troubles and occasional false positives. During early testing phases, an initial dataset from July flagged 6,450 files as potential malware cases, a significant portion of which turned out to be false alarms. Among these were harmless artifacts such as the legacy RARBG_DO_NOT_MIRROR.exe files historically added to certain releases, routine fansub scripts designed to switch audio tracks dynamically, and benign scripts intended simply to open a web browser.
Subsequent data updates from late September reflect a more refined filtering process. TorrentClaw now officially designates a file as malware only when VirusTotal explicitly confirms the threat, reducing the confirmed tally to 34 instances in that specific snapshot. Independent review of the supporting data reveals direct links to individual VirusTotal reports for every confirmed case.
Nevertheless, experts note that the current detection figures are likely conservative. TrueSpec avoids downloading large executable files, prioritizes well-seeded torrents for efficiency, and cannot evaluate dead swarms that lack active participants. Furthermore, because TorrentClaw focuses its primary indexing efforts squarely on films and television shows, pirated software applications and video games remain largely outside the scope of its automated scanning protocols.
Malware detection represents only a fraction of TrueSpec’s oversight capabilities. Out of 687,057 probed torrents, the system flagged 1,265 entries as deceptive, encompassing programs disguised as video files and intentionally falsified video resolutions—representing less than 0.2 percent of the overall checked volume. Meanwhile, the most frequent "mislabeling" detected by the system is entirely benign. More than half of all probed torrents, or 55 percent, feature embedded subtitle tracks that are omitted from the release titles. While TorrentClaw officially flags these as missing labels, standard scene distribution rules do not require subtitles to be mentioned unless they are hardcoded into the video stream.
VLC Player Malware
A distinct pattern emerges when analyzing the confirmed malware torrents flagged by the platform. In 31 of the 34 confirmed cases, the malicious torrents bundle an executable file named directly after a current television episode or feature film, accompanied by a file named libvlc.dll and a genuine, playable video file stored within a subfolder.
Investigation into these payloads reveals that the application itself is a renamed copy of the legitimate VLC media player, carrying the official code signature issued by VideoLAN. The malicious vector lies entirely within the accompanying DLL file, which the media player automatically loads upon startup and which VirusTotal security engines successfully identify as a trojan.
These weaponized torrents mimic high-profile entertainment releases, including episodes of hit series like The Boys, Jujutsu Kaisen, and Frieren, alongside prominent feature films such as Dune: Part Three and Zootopia 2. Many of these listings fraudulently appropriate the names of established distribution and release groups, including SubsPlease, ETHEL, and YTS.
This specific distribution vector is well-documented in cybersecurity circles. Earlier this year, security researchers detailed a malicious campaign utilizing fraudulent SubsPlease releases disseminated via public trackers like Nyaa to spread the Vidar infostealer, operations often facilitated through compromised third-party uploader accounts. TorrentClaw’s logs show that its crawler harvested these 31 specific malicious torrents between February and August, with 22 discovered directly through its proprietary DHT crawler and the remainder gathered from external sources including Nyaa, The Pirate Bay, and TorrentDownload. All possessed active seeders upon ingestion, and approximately 15 remained actively seeded as of early October.
Built For AI, By AI
TrueSpec is not the only feature distinguishing TorrentClaw from traditional indexers. The platform also hosts a Model Context Protocol (MCP) server, enabling AI assistants such as Claude and Cursor to query the site’s index and retrieve .torrent files directly on behalf of users.
From a technical standpoint, this integration allows individuals to interact entirely through an AI assistant to locate media releases and pull torrent files without ever navigating to the website’s front end. According to Soto, certain automated accounts generate roughly 10,000 API requests daily, indicating potential integration by external third-party services or specialized automated tools.
Running an infrastructure capable of scanning hundreds of thousands of files remains remarkably economical. Soto reported that in July, the entire TrueSpec verification backend operated across just three server nodes costing a combined total well under $50 per month. Emphasizing the broader implications of these overhead costs, Soto noted that if automated verification can be achieved so cheaply, any major indexer could theoretically implement similar safety checks, though none currently do.
However, partially downloading content from vast numbers of decentralized swarms carries potential legal complications. While TorrentClaw’s Digital Millennium Copyright Act (DMCA) policy explicitly states that the platform does not host, store, upload, or distribute files, copyright holders may interpret automated fragment retrieval differently.
Addressing these concerns, Soto describes TrueSpec strictly as a read-only client that neither uploads nor seeds data, restricting its network activity to fetching the initial headers of video containers necessary for format verification. "It deletes everything once the analysis is done. We don’t store or serve any content, and we process every valid takedown notice we receive," Soto states.
To manage incoming legal requests, TorrentClaw has integrated artificial intelligence into its administrative workflow. In late September, the site deployed an AI-managed takedown processing system that has successfully handled 23 formal notices, a sharp contrast to the roughly 300 predominantly duplicate notices received prior to its implementation.
To sustain its operations, TorrentClaw offers tiered subscription options, charging $3.99 per month for its PRO tier and $6.99 per month for a PRO+ package that bundles a virtual private network (VPN) service. Whether a commercialized, AI-driven approach to torrent indexing can maintain long-term stability remains to be seen, particularly as commercialized peer-to-peer services historically attract heightened scrutiny from rightsholders.
Leave a Reply