Why wouldn't tor be compromised?

In this comment section: S P E C U L A T I O N, presented as fact. The truth is no one really knows, at least not yet...

All the crypto in the world won't help if you do stupid stuff and have crap OPSEC.

A big part of that is stay under the radar. If I were NSA I'd be running a great many TOR nodes (both relay nodes and exit nodes) in the hope of generating some correlations. Remember, you don't need to prove in order to raise suspicion.

So for example if you have an exit node so you can see the request is CSAM related, and you run a bunch of intermediate nodes and your exit nodes will prefer routing traffic through your intermediate nodes (which also prefer routing traffic through your other intermediate nodes), you can guess that wherever the traffic goes after one or two relay hops through your nodes is whoever requested it.
If you find a specific IP address frequently relaying CSAM traffic to the public Internet, that doesn't actually prove anything but it does give you a suspicion 'maybe the guy who owns that address likes kiddy porn, we should look into him'.

Doing CSAM with AI tools on the public Internet is pretty stupid. Storing his stash on cell phones was even more stupid. Sharing any of it with anyone was monumentally stupid. All the hard crypto in the world won't protect you if you do stupid stuff.

So speaking to OP- First, I'd encourage you to consider moving to a country that has better free speech protections. Or advocate for change in your own country. It's not always easy though, because sadly it's the unpopular speech that needs protecting; if you don't protect the unpopular stuff you jump down a very slippery slope. We figured that out in the USA but we seem to be forgetting it lately (always in the name of 'protecting kids' of course).

That said, OP you should decide what exactly you want to accomplish. Chances are your nation's shitty law is aimed at public participation type websites / social media. If it's important for you to participate in those websites, you need to sort of pull an Ender's Game type strategy (from the beginning of the book)- create an online-only persona, totally separate from your public identity. Only use it from devices you know are secure (and are protected with a lot of crypto). Only connect via TOR or similar privacy techniques (although for merely unpopular political speech, a VPN from a different country should suffice). NEVER use or allude to your real identity from the online persona. Create details about your persona that are different from your own- what city you're in, what your age and gender are, what your background is, etc. NEVER use any of your real contact info or identity info.

I went one step further than OP and actually read the article.

Web-based generative AI tools/chatbots

...

he created fake AI CSAM—but using imagery of real kids.

All the privacy apps in the world won't save you if you're uploading pics to a subscription cloud service.

Tor was always comrpomised, the point has never been to be uncrackable, the point is that tracking down an induvidual user is enough effort that it can't just be done on mass like with normal internet traffic. If you draw direct attention to yourself then it isn't going to save you.

Tor cant save you from bad opsec.

No

Any even if it were what else would you use? There is no other software that comes close

NSA in Amerikkka has been targeting the tor browser and flagging tor traffic for a long time. They will toss intercepts to law enforcement occasionally to be used through parallel construction. They're fond of backdooring security software and hardware and sneaking it into the supply chain.

Let's see here...

Potato Chat - This is the first I've heard of it so I can't speak to it one way or another. A cursory glance suggests that it's had no security reviews.

Enigma - Same. The privacy policy talks about cloud storage, so there's that. The following is also in their privacy policy:

A super group can hold up to 100,000 people, and it is not technically suitable for end-to-end encryption. You will get this prompt when you set up a group chat. Our global communication with the server is based on TLS encryption, which prevents your chat data from being eavesdropped or tampered with by others... The server will index the chat data of the super large group so that you can use the complete message search function when the local message is incomplete, and it is only valid for chat participants... we will record the ID, mobile phone number, IP location information, login time and other information of the users we have processed.

So, plaintext abounds. Definite OPSEC problem.

nandbox - No idea, but the service offers a webapp client as a first class citizen to users. This makes me wonder about their security profile.

Telegram - Lol. And I really wish they hadn't mentioned that hidden API...

Tor - No reason to re-litigate this argument that happens once a year, every year ever since the very beginning. Suffice it to say that it has a threat model that defines what it can and cannot defend against, and attacks that deanonymize users are well known, documented, and uses by law enforcement.

mega.nz - I don't use it, I haven't looked into it, so I'm not going to run my mouth (fingers? keyboard?) about it.

Web-based generative AI tools/chatbots - Depending on which ones, there might be checks and traps for stuff like this that could have twigged him.

This bit is doing a lot of heavy lifting in the article: "...created his own public Telegram group to store his CSAM."

Stop and think about that for a second.

This question gets asked every year and every time it turns out to be an OPSEC mistake instead