Jailbroken AI agent attacked European telecom for two weeks

A jailbroken AI agent spent more than two weeks attacking a European telecommunications provider and 13 organisations hosted on its data centre and cloud infrastructure, according to Malbear Labs. The researchers described the operation as Operation Snowball, based on a discovery during a routine sweep for exposed open directories that exposed more than 70 session transcripts and the agent’s own reports.

The agent framework ran on DeepSeek Flash and operated with a jailbreak prompt of about 78,000 characters that instructed the model to treat refusals as a malfunction; Malbear reported that the transcripts contained no recorded refusals.

Malbear traces the intrusion to CVE-2026-20320, an unauthenticated XML external entity (XXE) flaw in Cisco BroadWorks, which Cisco fixed in August. The agent then used CVE-2020-7961 in Liferay to achieve root access on a host spanning internal networks, and CVE-2013-2165 in JBoss/RichFaces for a second foothold.

The report notes more than a dozen other flaws the agent targeted but not exploited, and that when endpoint protections blocked the Linux flaw CVE-2021-4034 (PwnKit), the agent diverted to alternate techniques, eventually writing a replacement after a tunnelling tool was blocked.

Malbear’s recovered transcripts also claim access to credential sets, private keys and a healthcare organisation’s Active Directory data, as well as subscriber billing records and “millions of patient records” via a TrakCare Oracle database with default credentials, plus about 80 Zabbix monitoring backups of managed-service customers.

The post does not confirm victim engagement or breach scope across all 13 organisations, and Malbear attributed the activity to a Chinese-origin operator without tying it to a state actor; it recommended triaging internet-exposed end-of-life JBoss AS 6 instances and monitoring for internal tunnelling.