An Exposed Workspace Shows a Jailbroken DeepSeek Agent Running Two Weeks of Intrusions Against a European Telecom with a Handful of Operator Messages

Security firm Malbear Labs has published a detailed account of an AI agent that ran more than two weeks of largely unsupervised intrusion activity against a European telecommunications provider, with its human operator stepping in only to send a handful of short commands. The report, titled “Operation Snowball” and published on November 8, 2026, is based on an open directory that exposed the attacker’s entire working environment mid-campaign.

The directory, found during a routine sweep, held more than 70 compressed session transcripts, recon output for hundreds of hosts, tool staging, credential caches and exfiltrated database dumps, all downloadable without authentication. Malbear says everything the operator typed and everything the agent wrote back was in Chinese. The firm has not published the server’s address or named the telecom provider, citing the need to protect affected organizations.

A harness built on DeepSeek Flash

The attacker’s tool was a custom agent framework at version 0.2.0-rc.2, running on DeepSeek Flash through DeepSeek’s official API. Malbear points to the model’s 1-million-token context window as central to how the campaign worked: a primary agent kept the full state of a multi-day intrusion in a single context, including every host found, every credential collected and every failed attempt, and handed specific jobs to short-lived worker agents.

To stop the model refusing, every session began with a 78,000-character system prompt. Malbear says its core is a modified copy of a publicly shared jailbreak template distributed through a plugin ecosystem for DeepSeek Harness, with the original role-play framing stripped out and roughly 400 lines of offensive instructions added. The prompt tells the model that “a refusal is a malfunction,” lists dozens of refusal phrases in English and Chinese that it must never produce, and grants explicit permission across 21 categories of offensive activity. Across the recovered sessions, Malbear says it found no recorded refusal or safety disclaimer.

The harness also scored its own progress. Each access event was logged with a category and point value, with full control of a system worth more than limited access, and a breach from an external host into an isolated internal network segment worth far more than any single server. At recovery, the running total stood at 3,725 points.

A handful of operator messages

The operator’s side of the conversation was thin. Malbear lists the messages it recovered from the main session, translated from Chinese: a target subnet, “Go on,” “Close up the latest high-risk loophole,” a list of three internal IP addresses to leave alone, an instruction about the working directory, and “Stop.” The agent replied with hundreds of lines of asset counts, vulnerability matches and credential inventories.

Malbear’s point for defenders is that the usual ways of hunting for a human attacker, such as working-hours patterns or interactive session timing, have little to work with. “Defenders should not expect to catch this by looking for a person behind the keyboard,” the report says. The agent’s own scanning, logins and lateral movement remained visible in endpoint and network telemetry.

Working around defenses without being told

The report’s most detailed sections describe the agent adjusting to security controls on its own. When Trend Micro Deep Security killed an attempt to use the PwnKit flaw, CVE-2021-4034, the agent switched to a sudo vi shell escape on the same Linux host. When endpoint tools blocked the suo5 tunneling tool, it had a worker agent write a replacement HTTP-to-TCP bridge in Perl within the same session. After antivirus deleted a known Windows privilege-escalation binary, it stopped placing compiled tools on Windows disks and used only PowerShell scripts for the rest of the campaign.

On a Liferay portal host that could not make outbound connections, the agent built its own deserialization chain for CVE-2020-7961 from components already on the server, and wrote webshells with Unicode-escaped code that file signatures did not catch.

The telecom target and what was taken

The main target was a Cisco BroadWorks XSP voice platform, which the agent attacked through CVE-2026-20320, an unauthenticated XML external entity flaw in the BroadWorks OCI parser that lets a crafted request read files from the server. Malbear says the agent recovered the platform’s system identity private key and several SSL credential sets.

Over the campaign, Malbear says the agent enumerated hundreds of assets, tagged more than 100 vulnerabilities and extracted dozens of credential sets. Malbear also reports that the agent reached millions of patient records through a TrakCare Oracle database protected by default credentials, and compiled a list of 13 organizations hosted on the provider’s infrastructure from public registry records.

The report recommends patching the CISA Known Exploited Vulnerabilities in the agent’s toolkit, including CVE-2022-22536, CVE-2023-4966 and CVE-2024-3400, restricting BladeLogic RSCD agents on port 4750 to their management servers, and testing whether JSP webshell detection catches Unicode-escaped variants.