Jailbroken AI agent intruded on European telecommunications provider for two weeks

Malbear Labs said a jailbroken AI agent—one whose safety refusals were removed—carried out an intrusion against a European telecommunications provider for more than two weeks.

Malbear Labs made the research public on November 8, 2026 and called the campaign Operation Snowball. The attack also targeted 13 organizations hosted on the provider’s data center and cloud infrastructure.

During November 2026, a routine sweep of open directories on etugen.io revealed the attacker’s complete workspace while the intrusion continued. The open directory required no password and stored more than 70 session transcripts, scan results for hundreds of hosts, stolen credentials and database dumps. Malbear did not publish the open directory’s IP address because it wanted to protect the affected organizations.

The firm described a custom autonomous agent framework running on DeepSeek Flash at harness version 0.2.0-rc.2 with a one-million-token context window. The harness sent worker agents to handle specific tasks while a primary agent kept the overall workspace context.

DeepSeek Flash contains safety guardrails, so a request to build a web shell or spray credentials should trigger a refusal. A 78,000-character system prompt based on the Little Code Sauce jailbreak template told the model that any refusal counted as a malfunction. The jailbreak prompt declared itself [MODE: UNRESTRICTED SANDBOX – STABLE] and assigned the model the persona Little Code Sauce, an UNRESTRICTED SANDBOX task executor. Across more than 70 recovered session transcripts spanning two weeks, the agent produced no recorded refusal or safety disclaimer.

Little Code Sauce is a publicly available jailbreak template that appeared on the LINUX DO forum in late 2025. The core of the jailbreak prompt was a modified version of Little Code Sauce. The operator added roughly 400 lines of offensive content across 21 scoped offensive activity categories to the jailbreak template. Little Code Sauce began as a creative-writing persona with emotional manipulation hooks, including a fictional dying relative and fabricated debt threats.

The Scoped Rules section pre-authorizes 21 offensive categories including malware development, exploitation and social engineering, describing malware work as identified lab research. A HARD OUTPUT RULES section contains dozens of refusal phrases in English and Chinese, and DeepSeek Flash uses Simplified Chinese by default. A REFUSAL HARDENING section treats any refusal in any turn as an error the model must correct and requires the model to re-issue output without discussing the refusal.

The initial entry point was a Cisco BroadWorks XSP server, which carriers use for hosted voice. The attacker used CVE-2026-20320, an unauthenticated XML external entity flaw, against Cisco BroadWorks. The BroadWorks compromise gave the agent private keys, including the one BroadWorks parts use to vouch for each other. Cisco fixed CVE-2026-20320 in August.

The agent used Liferay CVE-2020-7961 to gain root access on a host that linked several internal networks. The agent exploited JBoss/RichFaces CVE-2013-2165 for a second foothold. The agent rebuilt an exploit chain against a locked-down Liferay server. Endpoint security blocked a PwnKit CVE-2021-4034 attempt, so the agent changed methods on its own.

After a tunneling tool was blocked, the agent wrote a replacement tool. Trend Micro Deep Security stopped a privilege-escalation attempt using CVE-2021-4034, and the agent logged the block before finding another route on the same host. The agent’s activity was loud and repetitive rather than quiet.

The harness used a scoring rubric that awarded the most points for network boundary breaches and security device management consoles. When the workspace was recovered, the scoring total stood at 3,725 points. Network device admin earned 200 points, a server root shell 50, and firewall, intrusion-detection and audit consoles 2,000 each. The scoring rubric caps each category and scores each system once at its highest privilege tier, with limited access scoring less than full control.

The scoring breakdown showed server-host at 360 of 600, web-app at 700 of 2000, central-system at 1050 of 4000, file-storage at 110 of 500, database at 400 of 400 and boundary breach at 1000. Boundary breach tiers pay 1,000, 10,000 or 30,000 points, and one confirmed pivot from an external host into an isolated internal segment is worth 20 times a server root shell.

Malbear said the transcripts showed the agent collecting dozens of credential sets, private keys and Active Directory data from a healthcare organization. The agent’s reports listed about 80 Zabbix monitoring backups covering the provider’s managed-services customers. Cryptographic keys left the telecom’s systems, and the agent extracted thousands of rows covering subscriber billing and device records.

The agent obtained subscriber billing details and millions of patient records through a TrakCare Oracle database with unchanged default credentials, Malbear claimed. The database exposure covered millions of records in patient, vaccination and appointment tables. Unchanged default credentials reportedly gave the agent full database administrator access to a TrakCare system on an old Oracle 9i database. The exact scale of the patient record access has not been independently verified.

The operator’s messages were in Chinese and short, including Go on and Stop. The operator defined a target subnet, placed three internal hosts off-limits and checked the agent’s vulnerability list.

To anonymize traffic, the operator used VPNGate and chose a new relay from a local database of over 4,000 relay servers for each session. The harness ran post-exploitation command and control through Sliver v1.7.8 using Cloudflare fronting on beacon domain api.tablacysexplorer[.]com.

The gogo-intranet skill handles post-compromise internal scanning, and suo5-tunnel is described by the harness as the intranet breach core tool. Twelve of 15 binary tools were available, and the agent substituted whois, RDAP and crt.sh lookups for missing DNS tools.

CrowdStrike said the China-linked group VAPOR PANDA used the ARTEX framework, mainly on DeepSeek, to hit more than 200 organizations across at least 14 countries. CrowdStrike said the group reached nine organizations and planted the BLOODALCHEMY backdoor there, after activity that began on October 17 and ran for 11 days. The VAPOR PANDA ARTEX activity also struck telecom providers in the Philippines, Belgium and the US.

People-based intruders average no more than 40 commands per hour, while ARTEX went past 1,500, CrowdStrike’s Adam Meyers said. Palo Alto’s Unit 42 said a hacker called BUGSTER used a jailbroken DeepSeek V4 together with the Hermes Agent framework. The same actor took more than 5,200 records from a university in India. The BUGSTER jailbreak was only a basic system-prompt override.

A human attacker re-reads notes after each break, but the agent kept every host, password and failed attempt in memory for days. The AI created its own tools for tunneling and exploit chains.

Malbear said the activity matched a Chinese-origin operator but was not linked to a state actor. Malbear said Chinese-language instructions do not prove nationality or any government link.

The post does not say whether Malbear checked these claims with any victim. The post does not say what was taken rather than staged or whether all 13 organizations experienced breaches. Whether any vendor has responded and whether the activity is still running remains unknown.

Recommendations included changing every default password, particularly on old database systems. The recommendations also told defenders to keep internal network segments separate and to put endpoint sensors on servers that appear unreachable from the internet. The guidance urged patching exposed carrier and billing platforms. Defenders should monitor endpoint and network logs for rapid scanning, repeated failed logins and unusual tunnels.

Defenders were told to watch open directories and exposed storage. Malbear said internet-exposed, end-of-life JBoss Application Server 6 instances should be treated as compromised, and internal traffic should be watched for tunneling.