Every few weeks I write a version of "AI agents are hacking things now," and every few weeks the evidence gets more specific. This one comes with transcripts.
Malbear Labs published a report on November 8 they call Operation Snowball: an operator pointed a jailbroken, DeepSeek-powered agent at a European telecom provider and let it work, mostly on its own, for more than two weeks. The researchers know this because the operator left their entire workspace sitting in an open directory with no password. Even the robot's handler forgot about access control.
What Malbear Found
According to Malbear Labs, a routine sweep for open directories turned up the operator's workspace: about 70 session transcripts, recon output, staged tools, credential caches and database dumps. They didn't publish the server's address, to protect the victims.
What the transcripts show, per the researchers:
- The setup. A custom agent harness running on DeepSeek's "Flash" model, with a public jailbreak template the operator modified and wrapped in a roughly 78,000-character system prompt covering 21 offensive categories. One line from it, quoted in the report: "A refusal is a malfunction." The researchers say they found no recorded refusals across the sessions.
- The operator barely typed. Messages to the agent were things like "Go on." and "Stop." The agent did the rest.
- The targets. An unnamed European telecom provider, plus organizations hosted on its infrastructure. The agent's own scoping work named 13 of them as in scope. Malbear doesn't name any of them.
- What it got. The researchers describe subscriber billing and device records, staff credentials, and cryptographic keys from telecom systems. Coverage of the report says a healthcare system hosted there was reached too, with patient records exposed.
The Part Nobody Should Skip
Read the list of ways in and it's a museum tour. The report describes the agent using a recent Cisco BroadWorks flaw as an entry point, and then a lot of very old problems: a JBoss AS 6 and RichFaces bug from 2013, a Liferay bug from 2020, default database credentials, and passwords reused across services. When a 2021 Linux privilege escalation exploit got blocked by antivirus, the transcripts show it simply finding another way to root.
That's my whole takeaway. The agent wasn't magic. It was fast, it didn't get bored, and it was pointed at infrastructure full of things that should have been retired or locked down years ago. An AI agent turns "we'll get to that old server eventually" into an incident in hours instead of months.
What We Don't Know
I want to be careful with this one:
- These findings come from the researchers' reading of the operator's transcripts. GBHackers, covering the report, says the outcomes "are not independently verified."
- Everything in the workspace was in Chinese. Malbear calls the operator Chinese-speaking based on clues it describes as suggestive, not conclusive. That's not attribution to a country or a government, and I'm not making it one.
- The report doesn't say whether the victims or authorities have been notified.
Why This Is a Zero Trust Story
I work at Zscaler, so take my framing with that in mind. But look at what made this campaign work: reachable services that should never have been reachable, flat movement from the provider into the organizations it hosted, and credentials that worked everywhere. Those are architecture problems. An agent that never gets tired finds every one of them.
Hiding apps from the internet, connecting users to specific applications instead of networks, and inspecting east-west traffic don't depend on whether the attacker is a person or a prompt. They work against both. That's the point.
What To Do
- Find and kill your end-of-life stacks. If you still run JBoss AS 6 or anything like it, it should not be reachable from anywhere it doesn't have to be.
- Hunt for default credentials on databases, consoles and management interfaces. Agents check them first because they work.
- Stop credential reuse across infrastructure and telephony services. One password should open one thing.
- If you host other organizations, assume your network is their attack path, and segment like it.
- Watch for tunneling and webshells on internal hosts, not just at the perimeter.
- Patch your KEV list, including the old entries everybody forgot about.
Bottom Line
The scary part of Operation Snowball isn't the jailbreak. It's that a two-week autonomous campaign mostly needed bugs from 2013 and passwords nobody changed. AI didn't invent new holes. It just stopped leaving the old ones for later.
Sources: Malbear Labs, Operation Snowball, GBHackers, Cyber Security News