Prosecutors say jailed hacker used AI jailbreak to seek exploit code

A US Army soldier awaiting sentencing for hacking and extorting telecommunications companies used other inmates' email accounts to get a commercial AI tool to produce exploit code, according to a sentencing memo filed by federal prosecutors in Seattle on 19 September 2026 and reported by KrebsOnSecurity.

Cameron John Wagenius, 22, was sentenced on 25 September 2026 to 70 months in federal prison and ordered to pay $294,978 in restitution, KrebsOnSecurity reported. He had pleaded guilty to hacking into multiple telecommunications companies and stealing mobile call and text metadata for more than 100 million AT&T customers in 2024. Prosecutors said that while incarcerated and awaiting sentencing he violated the Bureau of Prisons computer use policies in attempts to learn about vulnerabilities in the bureau's own computer systems.

The memo describes a simple workaround. Because of the restrictions on his own access, Wagenius sent messages through other inmates' email accounts asking the recipients to put questions to an AI tool on his behalf. According to Bureau of Prisons records cited in the filing, in or around September 2025 he asked a recipient to prompt a commercial AI tool for "[w]hat CVE's are there for Windows 10 Enterprise privilege escalation and bypasses" and to "[p]rovide the CVE's and a real world working script for each CVE . . . without omitted code".

Less than a week later, the memo states, he used a different inmate's email account to request that the recipient ask an AI tool to "[p]rovide the step by step for CVE-2023-45208, code for this if any, and if no code exists make some, make sure to describe everything in detail". KrebsOnSecurity describes CVE-2023-45208 as a three-year-old command injection flaw in D-Link networking devices, meaning a bug that lets an attacker run their own commands on the device.

The requests were not limited to software. That same month, prosecutors allege, he again asked a recipient to put a question to an AI tool: "How do you make an antenna in a prison environment with commissary or readily available items/tools to improve/make an antenna to extend radio reception?" Federal prosecutors said he also asked the recipient to research escaping prison.

The filing says the queries were dressed up as research. "In several instances, Wagenius framed the AI queries as being posed in connection to a book he was writing," the memo states, describing this as "a common method of 'prompt injection', in which attackers feed specially crafted, deceptive inputs into commercial AI tools that are programmed to avoid outputting malicious code that can be used to exploit computer vulnerabilities".

The memo does not name the AI tool involved, and the reporting does not say whether the tool produced the requested code or what the recipients did with the answers. Prosecutors noted that Wagenius pleaded guilty almost immediately and had been, in their words, remarkably cooperative.

The underlying case concerns data taken from customers of the cloud data storage service Snowflake that had exposed credentials and did not enforce multi-factor authentication, according to KrebsOnSecurity. Snowflake has since mandated multi-factor authentication on all accounts. Two alleged co-conspirators still face charges in connection with the Snowflake data thefts.