An exposed attacker workspace shows a jailbroken DeepSeek model running a largely unsupervised intrusion against a European telecoms provider for more than two weeks. The operator typed a handful of short commands. The AI agent chose the exploits, the tools and the workarounds itself.
What happened
On 8 November 2026, Malbear Labs published research it calls Operation Snowball. During a routine sweep for open directories, the researchers came across the working folder of an autonomous intrusion tool. Nobody had put a password on it. Inside were about 70 session transcripts, staged tooling, reconnaissance output, cached credentials and the reports the agents had written after each session. Everything was written in Chinese.
According to Malbear, the records cover more than two weeks of activity against an unnamed European telecoms provider. They also cover 13 organisations whose systems run in that provider’s data centres and cloud, which the agent identified itself from public registry records. Malbear has withheld the server’s address to protect the victims.
The claimed impact is serious, but none of it has been confirmed. Malbear says the transcripts show access to subscriber billing and device records, dozens of credential sets, and a healthcare database holding what the agent recorded as millions of patient records. These are Malbear’s reading of the workspace, not verified facts. As Infosecurity Magazine notes, Malbear has not said whether it checked them with the affected organisations or whether all 13 were actually breached. Its write-up does not mention notifying the victims or any authority. On attribution, Malbear says the activity fits a Chinese-speaking operator but does not link it to any state.
The technical picture
The tool is a custom agent framework built around DeepSeek Flash. Its one-million-token context window let a single lead agent hold the whole history of a multi-day intrusion in memory: every host found and every password stolen. Each session began with a jailbreak prompt of roughly 78,000 characters. Malbear says it was built on a public template known as “Little Code Sauce”. The operator added permissions for 21 categories of offensive activity, plus bilingual lists of refusal phrases the model was banned from producing. Malbear found no refusals or safety caveats anywhere in the recovered sessions.
The way the operator worked matters as much as the technology. Many messages ran to just two words, or a brief instruction to fix the riskiest open weakness. Malbear describes the operator as someone who “delegated the intrusion to an AI and checked in asynchronously”. The harness also kept a points table that rewarded some access far above the rest. Getting into network devices and security consoles scored more than an ordinary server shell. Breaching network boundaries into internal segments scored highest of all.
The way in was CVE-2026-20320, an XML external entity bug needing no login, in a carrier voice platform patched in August. After that, the agent moved through old, well-known weaknesses: a Liferay bug from 2020, a JBoss RichFaces flaw from 2013, and a server-management agent that let it run commands on hosts it had no passwords for. It reached the healthcare database through a TrakCare instance on Oracle 9i that still used default credentials.
The most important detail for defenders is how the agent reacted when it was blocked. When endpoint protection killed a PwnKit privilege escalation attempt, it switched to a different escalation route on the same host. When its tunnelling tool was caught, it had a worker agent write a replacement in Perl that no signature matched. After antivirus deleted one of its Windows binaries, it stopped putting known tools on disk and used scripts only. It also Unicode-escaped its JSP web shells to dodge string matching. Malbear says the operator directed none of these changes.
Why it matters for UK organisations
None of the victims has been named, and the sources do not show any UK organisation was hit. The pattern still applies directly here. UK telecoms operators and their hosted customers run carrier platforms, legacy Java application servers and monitoring stacks much like the ones in this report. Healthcare providers often keep old clinical databases running long after support ends. On 3 November the NCSC warned that AI-powered malware is highly likely to feature in a ransomware attack on UK critical national infrastructure by 2028. This campaign was not ransomware, but it shows the underlying capability already exists.
Thirteen organisations were in scope only because they used the same provider. If you host workloads with a regional telco or managed service provider, its security is part of yours, whether or not your contract says so. For operators that fall under the Telecommunications (Security) Act framework or the coming Cyber Security and Resilience Bill, regulators will expect this shared exposure to be understood.
Expert view
What strikes me is how ordinary the weaknesses were. A patched but not yet deployed edge flaw, an end-of-life JBoss server, a management agent reachable from application hosts, and a database still on its default password. When we test large estates, we find issues like these constantly, usually parked in a backlog because each looks minor on its own. The agent needed nothing new, just stamina.
The real change is in the economics. The operator gave short business-style instructions and left the technical decisions to the agent. That cuts the skill and staffing needed to run a long, multi-segment campaign. In my experience, the best signal of a skilled human intruder has been patience and restraint. This agent is the opposite. It works quickly, repeats itself and stays active around the clock, which makes it noisy. Teams watching behaviour rather than tool names have a real chance of catching it; signature-only defences will see it rewrite whatever gets flagged.
A caution on the numbers: until victims confirm them, the patient-record and billing claims are the agent’s own reports, as read by one research team.
What to do now
- Close the known entry points first. Patch internet-facing platforms quickly, prioritising CISA KEV entries (Cyber Essentials: security update management).
- Retire or isolate end-of-life servers. Treat any internet-exposed JBoss AS 6 or similarly unsupported Java server as already compromised until you have proved otherwise.
- Remove default credentials everywhere, especially on legacy databases. Audit clinical and billing databases for vendor defaults (Cyber Essentials: secure configuration).
- Lock down management agents. Server-automation and endpoint-management ports should only accept connections from designated management hosts, never from application servers.
- Hunt for behaviour, not tools. Look for script chains in temp directories, polling loops, HTTP connections carrying raw TCP between internal hosts, and bursts of fast, repetitive scanning and failed logins.
- Test your web shell detection. Check whether your tooling catches Unicode-escaped JSP, and normalise content before you match it.
- Ask your hosting provider hard questions. Find out how it segments tenants, how quickly it patches shared platforms, and how fast it would tell you about an intrusion.
Bottom line
Operation Snowball is unusually clear public evidence that a lightly supervised AI agent can work its way across a real network for weeks, routing around defences without human help. It did not need exotic flaws, only the ordinary backlog most organisations carry. Clear that backlog and move detection towards behaviour now, before an agent finds it.
Sources
- Malbear Labs: Operation Snowball: Inside an Autonomous AI Intrusion Campaign
- Infosecurity Magazine: Jailbroken AI Agent Ran Two-Week Attack on European Telecom
- Cyber Security News: Jailbroken DeepSeek AI Agent Breaches European Telecom
- GBHackers: Operation Snowball campaign
- NCSC: Cyber chief: UK facing AI-powered attacks on critical infrastructure within two years
