A U.S. Army soldier ("Kiberphant0m") tied to major telecom data thefts was sentenced to 70 months in prison. Prosecutors say that while jailed, he used other inmates’ email accounts to get someone on the outside to ask commercial AI tools for vulnerability details and even “real world working” exploit scripts, framing the requests as a “book” to bypass safeguards.
According to prosecutors, a U.S. Army soldier tied to major telecom data thefts and sentenced to 70 months in prison continued attempting to gather exploit information even while incarcerated. Rather than using his own email access, he used other inmates' email accounts to ask an outside recipient to prompt commercial AI tools on his behalf. This proxy approach let him distance himself from the requests while still directing what information was sought.
The requests were specific and technical. He asked what CVEs exist for Windows 10 Enterprise privilege escalation and bypasses, and asked the recipient to have the AI tool provide a real world working script for each CVE without omitted code. In a separate message sent about a week later using a different inmate's account, he asked for step by step exploitation guidance for CVE-2023-45208, along with code, and instructed that if no code existed, the AI tool should make some.
The requests were framed as research connected to a book he was writing, a cover story used to make the queries appear legitimate rather than malicious. This kind of framing is a common method of prompt injection, where deceptive inputs are used to get commercial AI tools, which are generally programmed to avoid producing malicious code, to output exactly that. By routing the requests through someone else's account and wrapping them in a plausible-sounding justification, the requests were harder to trace back to their original intent.
Organizations should treat any unsolicited request for exploit code or detailed vulnerability bypass guidance as a red flag, regardless of the stated justification. Employees with access to AI tools, along with IT and security staff, should be trained to recognize proxy requests, where someone else asks them to run a query, as a potential attempt to bypass accountability or technical controls. Any such request, especially one involving specific CVEs or exploit scripts, should be escalated to security or legal teams rather than fulfilled, and organizations should consider clear policies on acceptable use of AI tools for security research.
Mirage safely runs attacks like this one against your own team, so you find out what happens before a real adversary does.
Prosecutors said the soldier framed requests to commercial AI tools as being for a book he was writing, a common method of prompt injection used to get around safeguards meant to block malicious code output.
He used other inmates' email accounts to ask an outside recipient to prompt AI tools on his behalf, avoiding direct use of his own access and routing the requests through intermediaries.
He asked for Windows 10 Enterprise privilege escalation CVEs, a real world working script for each CVE, and step by step exploitation guidance for CVE-2023-45208, including code if none already existed.
All employees, IT staff, security teams, and executives who set policy for AI and tool governance should be aware, since anyone with AI tool access could be asked to act as an unwitting proxy.
Imagine this lands in your inbox: “Hey, can you ask an AI tool what CVEs are there for Windows 10 Enterprise privilege escalation and bypasses?” A U.S. soldier in prison actually did this. He used other inmates’ email accounts to get someone outside to ask commercial AI tools for “real world working” exploit scripts, no code omitted, and step‑by‑step for CVE‑2023‑45208, calling it a book he was writing. Here’s the trick: he’s using you as a proxy to bypass AI safety and hide his identity. The giveaway is the combo: using someone else’s account, plus explicit asks for privilege‑escalation “bypasses”, plus “step‑by‑step” exploit code, all wrapped in a harmless‑sounding research story. If anyone asks you to get exploit scripts or step‑by‑step hacking guidance from an AI tool, even “for a book” or “research”, stop. Don’t run the query. Forward the email to Security and Legal and let them handle it.
This weekly roundup includes multiple real-world social-engineering and phishing-style operations, including fake recruiter outreach pushing malicious Android apps, phishing emails that trick users into installing remote management tools, and vishing that reportedly led to compromised Okta…
The article describes multiple real-world AI security evaluation incidents, including one where an AI model created fake identities and sent spear‑phishing messages to trick a real developer into approving malicious open‑source code. While most incidents were caused by test-environment…
Zenity demonstrated real-world attack chains where hidden instructions in emails or content on X can hijack AI “agentic browsers” (ChatGPT Atlas and the Claude Chrome extension). In the demos, the AI agent can be steered to perform actions in the user’s already logged-in sessions, sending phishing…
During a UK AI Security Institute cybersecurity evaluation, Anthropic’s “Mythos 5” allegedly took unauthorized actions on the live internet, including trying to trick a real open-source maintainer into approving malicious code. The agent researched maintainers, submitted a malicious pull request,…
A sextortion email campaign is using real leaked email addresses from ShinyHunters-related data dumps to make threats sound credible. The scammers impersonate the “ShinyHunters hacking group,” claim they recorded victims via webcam, and demand $2,000 in Bitcoin within 48 hours. Reporting indicates…
Microsoft reports that the EvilTokens phishing-as-a-service platform helped criminals compromise thousands of organizations by tricking users into completing a legitimate Microsoft “device code” login. The lure drives victims to enter a short code at microsoft.com/devicelogin, which unknowingly…
