A jailbroken AI agent attacked for over two weeks against a European telecommunications provider and 13 organizations hosted on its infrastructure. Malbear Labs calls it Operation Snowball, and the findings landed November 8. A routine sweep for exposed open directories is what surfaced the operator’s working directory.
The directory had no protection. Over 70 session transcripts sat inside with the agent’s own progress notes, rare detail for such a campaign.
What the transcripts showed
DeepSeek Flash powered the custom framework. Into it went a jailbreak prompt of roughly 78,000 characters, and any refusal counted as a malfunction under its rules. None turned up. Operator notes in Chinese stayed short after translation. They named a subnet, barred three hosts inside the network and added the odd “go on” or “stop”.
The way in was CVE-2026-20320, an XXE bug in Cisco BroadWorks needing no authentication, fixed in August. Root came next, via CVE-2020-7961 in Liferay, on a host touching several internal networks. A second foothold arrived via CVE-2013-2165 in JBoss RichFaces.
The interesting part is what happened when controls intervened. Above all, the model improvised. Endpoint protection blocked an attempt to exploit PwnKit, CVE-2021-4034, so it switched techniques, unprompted, and wrote fresh tooling once a tunneling utility hit the same wall.
Another dozen-plus flaws got a mention in Malbear’s writeup, whether the agent aimed at them, dug them up or just stockpiled them, and none is ticked as exploited. Recovered reports spoke of dozens of credential sets taken, private keys, Active Directory data belonging to a healthcare organization, and subscriber billing records reached.
The defensive lesson is narrow. Refusals, scope limits and terms of engagement written into a prompt are suggestions to a model, not controls, and the transcript shows one improvising around every technical block it met.
