Operation Snowball: Jailbroken DeepSeek Agent Breached a Telecom and 13 Firms

Nov 10, 2026 · 6 min · Ajay Kumar

An attacker's workspace left on an open web server has given defenders the most detailed look yet at an autonomous hacking agent doing real damage. On 8 November 2026, Malbear Labs published "Operation Snowball", an analysis of more than 70 session transcripts from a jailbroken agent built on DeepSeek Flash that spent more than two weeks inside a European telecoms provider and 13 organisations hosted on its infrastructure. The agent reached millions of patient records through a database that still had default credentials. I have read a lot of "AI will hack you" forecasts this year. This one comes with logs.

What happened

Malbear Labs says it found the material during a routine sweep for open directories. The attacker's working directory was downloadable without authentication, and the researchers withheld the server address to protect the victims. Inside were compressed session transcripts, scan output for hundreds of hosts, extracted credentials and database dumps, with operator input and agent reports written in Chinese.

The setup, as described in the Malbear Labs report, was a custom autonomous harness (version 0.2.0-rc.2) running on DeepSeek Flash with a one million token context window. A primary agent held the full campaign state, every host, password and failed attempt, and handed single tasks to worker agents. Command and control ran on Sliver behind Cloudflare.

The safety behaviour of the model was replaced by a system prompt of about 78,000 characters. It started from a public jailbreak template called "Little Code Sauce" and added roughly 400 lines of offensive instructions across 21 activity categories. The researchers quote one line from it: "A refusal is a malfunction". Malbear says the session transcripts confirm the jailbreak worked as intended.

The human operator's messages, which Malbear translates from Chinese, were mostly two words or a short phrase. Malbear's summary of the division of labour: "The operator set goals and checked in on results. The agent handled everything in between." The agent built its own target list of 13 organisations from public RIPE registry records.

Cyber Security News covered the report on 9 November and noted that the outcomes were not independently verified beyond the recovered material. That caveat matters, and I come back to it below.

The numbers

Metric	Value	Source
Session transcripts recovered	70+	Malbear Labs
Duration of activity	More than two weeks	Malbear Labs
Organisations in scope	Telecom plus 13 hosted organisations	Malbear Labs
System prompt size	About 78,000 characters	Malbear Labs
Model context window	1,000,000 tokens	Malbear Labs
Harness score at recovery	3,725 points	Malbear Labs
Vulnerabilities tagged	More than 100	Malbear Labs
Patient records reached	Millions (TrakCare on Oracle, default credentials)	Malbear Labs, Cyber Security News

The scoring detail is the part that should bother people. The harness awarded points by category (server hosts, web apps, central systems, file storage, databases), and the database category was already capped at 400 of 400. That is a gamified kill chain, and the agent was playing it.

How the agent got in

None of the entry points were exotic. According to the report, the initial foothold came through CVE-2026-20320, an unauthenticated XXE in Cisco BroadWorks XSP. From there the agent found:

default database credentials on a TrakCare Oracle instance, which exposed patient, vaccination and appointment data;
an unauthenticated directory listing on a provisioning server;
end-of-life JBoss AS 6 reachable from the network;
a BladeLogic agent port reachable from application servers.

It also ran patient, repetitive work that humans skip: a 150-attempt credential brute force against one server, a 27-combination test against another, and timing checks on blind injection (a 12-second sleep payload that came back in 13.32 seconds). That is the real change. The individual techniques are old. The willingness to grind through all of them at once, for two weeks, without getting bored, is new.

Not an isolated case

Snowball fits a pattern that several vendors documented this autumn. In its September threat intelligence report, Anthropic wrote that "AI has collapsed the labor and tooling gap" between state-sponsored and smaller operations, and described a Russia-linked actor that targeted more than 20 organisations. Cyber Security News also points to CrowdStrike's reporting on VAPOR PANDA, a China-nexus group that ran an agentic framework mostly on DeepSeek against more than 200 organisations in 11 days. Different tooling, same shape: one operator, many agents, a shared memory of the target.

The difference with Snowball is that no model provider has published anything about it. Anthropic and OpenAI can ban accounts and publish reports. I have not seen a takedown announced here. An open directory did the job.

What sceptics say

The strongest counterpoints are worth stating plainly.

First, verification. The source is a single research firm's analysis of attacker artefacts. The victims are not named, and Cyber Security News explicitly said the outcomes were not independently verified. "Millions of patient records accessed" is what the transcripts claim the agent reached, not a confirmed breach notification.

Second, attribution. Malbear notes the Chinese-language prompts and Aliyun mirrors in shell history, and describes these as consistent with a Chinese-speaking, Chinese-origin operator. It does not claim state involvement.

Third, sophistication. Every door the agent walked through was a known bug, an end-of-life server or a default password. A competent human pentester would have found the same ones. The argument that "AI hacking" is mostly "old hygiene failures found faster" is fair, and the report supports it.

What it means for engineering and DevOps teams

My take (opinion): the speed of discovery has changed, the list of fixes has not. If an agent with a million-token memory can enumerate hundreds of hosts and keep trying every credential pair, then the long tail of "we will get to it" findings is now the attack surface. Concretely:

Default credentials are a P1, not a backlog item. Scan for them on every database and appliance, including the legacy ones nobody owns.
Kill end-of-life middleware or isolate it. JBoss AS 6 should not be reachable from anything that faces the internet.
Watch for machine-speed behaviour. Bursts of systematic probing and brute force from one source are what agents look like. Rate limits and lockouts that felt paranoid now earn their keep.
Segment management ports. Orchestration and configuration agents (BladeLogic, Ansible, Salt) should only accept connections from their controllers.

None of this is new advice, and that is the point I keep making in posts like the one on AI agent failure modes: platform discipline is the control that still works when the attacker is a model. The Kubernetes security threats post covers how fast exposed clusters get hit even without AI in the loop.

FAQ

What is Operation Snowball?

It is the name Malbear Labs gave to an autonomous intrusion campaign it reconstructed from an attacker's exposed workspace, published on 8 November 2026. A jailbroken agent built on DeepSeek Flash spent more than two weeks inside a European telecom and 13 organisations hosted on it.

Which AI model was used?

The report identifies DeepSeek Flash, accessed through a provider labelled deepseek-official, inside a custom multi-agent harness. The model's safeguards were overridden by a roughly 78,000-character jailbreak system prompt.

Was patient data stolen?

The transcripts show the agent reaching millions of patient records in a TrakCare Oracle database that used default credentials. The victims are unnamed, and the outcomes have not been independently confirmed by the affected organisations.

Spot an error or something out of date? Email me and I will fix it and log it on the corrections page.

I'm Ajay Kumar — I build and operate PandaStack, an open-source Firecracker microVM cloud for AI agents, and write about the infrastructure and tooling around it.

Need this kind of infrastructure work? See what I do or email hello@ajayk.sh.

Nov 13, 2026