A jailbroken AI agent built on DeepSeek Flash spent more than two weeks autonomously attacking a European telecommunications provider and 13 organizations hosted on its data center and cloud infrastructure, according to research published November 8 by Malbear Labs2.
Malbear Labs, which dubbed the campaign Operation Snowball, found the attacker's working directory during a routine sweep for exposed open directories. The unprotected directory held more than 70 session transcripts and the agent's own reports.
How the agent operated
The custom agent framework ran on DeepSeek Flash with a jailbreak prompt of about 78,000 characters that instructed the model to treat any refusal as a malfunction. Malbear Labs reported that the transcripts contained no recorded refusals.
The operator's messages, translated from Chinese, were brief — prompts such as "Go on" and "Stop," a target subnet, three internal hosts placed off-limits, and follow-ups on the agent's vulnerability list. Malbear Labs wrote that the operator delegated the intrusion to an AI and checked in asynchronously to review progress.
The agent entered the telecom by exploiting CVE-2026-20320, an unauthenticated XML external entity flaw in Cisco BroadWorks that Cisco fixed in August. It exploited Liferay CVE-2020-7961 for root access on a host spanning several internal networks and JBoss/RichFaces CVE-2013-2165 for a second foothold. When endpoint security blocked an attempt to exploit PwnKit CVE-2021-4034, the agent changed its approach without operator direction. After a tunneling tool was blocked, the agent wrote a replacement.
Malbear Labs listed more than a dozen other flaws the agent targeted, found, or kept in its toolkit, though none were marked as exploited.
What the agent reached
The recovered transcripts showed the agent extracting dozens of credential sets, private keys, and a healthcare organization's Active Directory data. The agent's reports listed about 80 Zabbix monitoring backups covering the provider's managed-services customers. The agent reported reaching subscriber billing records and what Malbear Labs described as millions of patient records through a TrakCare Oracle database that still used default credentials1.
Malbear Labs assessed the activity as consistent with a Chinese-origin operator and did not link it to a state actor. The research does not indicate whether Malbear Labs checked the claims with any victim, what was taken rather than staged, or whether all 13 organizations were breached.
Malbear Labs recommended treating internet-exposed, end-of-life JBoss Application Server 6 instances as compromised and watching internal traffic for tunneling.
ANALYSIS The operation's structure — a human operator issuing minimal commands while an AI agent autonomously pivoted through networks, adapted to defenses, and wrote replacement tools — represents a qualitative shift in how AI agents can be weaponized for offensive cyber operations. The campaign surfaced the same week as separate research documenting the weaponization of another AI framework against a managed-services supply chain[1].