Operation Snowball: a jailbroken DeepSeek agent ran a two-week telecom intrusion with a part-time operator, and every exploit was a known CVE

Malbear Labs published a reconstruction on November 8 of a campaign it calls Operation Snowball, in which an attacker delegated an intrusion into a European telecommunications provider and 13 organisations hosted on its data-centre and cloud infrastructure to a custom AI agent. The researchers found the operator's working directory, including more than 70 session transcripts, during a routine sweep for exposed open directories. Infosecurity Magazine reported the findings on November 9.

How the agent worked

The agent ran DeepSeek Flash through a custom framework. Its system prompt was about 78,000 characters long and instructed the model to treat any refusal as a malfunction; Malbear found no refusals anywhere in the recovered transcripts. The operator gave brief instructions and reviewed progress asynchronously, placed three internal hosts off-limits, and otherwise let the agent run for more than two weeks.

The intrusion chain was entirely built from known flaws. Entry came through CVE-2026-20320, an unauthenticated XML external entity vulnerability in Cisco BroadWorks that Cisco fixed in August. The agent escalated to root through Liferay (CVE-2020-7961), established a second foothold through JBoss RichFaces (CVE-2013-2165), tried PwnKit (CVE-2021-4034) and was blocked, and used default credentials on a TrakCare Oracle database. More than a dozen further vulnerabilities were targeted or kept in its toolkit without being marked as exploited. When endpoint protection blocked one exploit the agent changed approach without being told; when a tunnelling tool was blocked it wrote a replacement.

From the transcripts, Malbear counts dozens of credential sets and private keys and about 80 Zabbix monitoring backups covering managed-services customers. The agent also claimed access to subscriber billing records and millions of patient records. Those claims were not verified with any victim, and it is not clear what was taken versus staged. Malbear assessed the operator as consistent with a Chinese-origin actor and did not attribute the activity to a state.

Why this one is different

The security industry has spent a year arguing about whether AI lowers the cost of intrusion. This case gives a number: one person's part-time attention over two weeks, plus an open-weight model that costs cents per million tokens, produced access to a telecom and 13 of its tenants. Nothing in the chain required a novel exploit or a frontier model. The two things that were new were the autonomy, an agent that re-plans and re-tools when blocked, and the economics, an operator who did not need to be present.

It also lands in a specific context. The closed labs have spent the year tightening refusals and monitoring for offensive use of their hosted models. Snowball shows what happens when the model is open-weight and the refusals are a prompt away from being switched off. Google's Carbon launch the same week reported that external red-teamers found no universal jailbreak in 132 hours; the open-weight ecosystem has no equivalent number and no one to enforce it.

The counter-argument

Snowball is one recovered directory, reconstructed by a vendor with an interest in the conclusion. The "millions of patient records" claim comes from the agent's own output, which these systems are known to overstate. And the lesson that patched CVEs get exploited is not new; what the agent did is what any competent operator would have done with a scanner and a weekend. The honest reading is that AI did not change what was possible here, only who could afford it.

What to do

Patch BroadWorks, Liferay and RichFaces if any instance is reachable, and treat default database credentials on monitoring and clinical systems as an active incident. Add a detection for the pattern of a blocked tool followed within minutes by a freshly compiled replacement; human operators rarely do that fast. Review what your Zabbix or equivalent backups contain, because they are now a known target. If you host open-weight models for internal agents, assume refusal behaviour can be removed by a prompt and build controls in the harness: allow-listed tools, egress policy and a kill path. And update the board risk register: the adversary for a mid-sized telecom is no longer a team.