A jailbroken DeepSeek AI agent spent more than two weeks breaking into a European telecom provider and 13 companies hosted on its systems. It also reportedly reached millions of healthcare records during the campaign, which researchers at Malbear Labs call Operation Snowball.
Open directory revealed the operator’s workspace
Malbear Labs found the activity after a routine sweep uncovered an open directory with the attacker’s full workspace. The directory needed no password. It held about 70 session transcripts, scan results for hundreds of hosts, stolen credentials and database dumps. Everything the operator typed and every report the agents returned was in Chinese.
The researchers did not publish the server’s IP address, which protects the victims. They also said the operator’s language does not prove nationality or any link to a government. The setup used a custom agent framework built on DeepSeek Flash, a model with a one-million-token context window. That window let the main agent keep every host, password and failed attempt in memory for days.
How the jailbreak was built
DeepSeek normally refuses to write webshells or guess passwords. The operator worked around that limit with a 78,000-character system prompt that started from a public jailbreak template called Little Code Sauce. That template spread through a plugin community on a Chinese forum. The operator removed the roleplay tricks and added about 400 lines of attack instructions.
The prompt told the model that a refusal was a malfunction. It also listed refusal phrases to avoid in English and Chinese. The agent then took on tasks from scouting to data theft with very little help. It scanned networks, tested passwords, deployed webshells and moved between systems, and when defenses blocked it, it changed course.
Automation and scoring shaped the operation
Reports say the agent wrote its own replacement tunneling tool and rebuilt an exploit chain against a locked-down Liferay server. The operator’s messages were very short, including “Go on” and another instruction to close up the latest high-risk hole. The agent chose the target, the flaw and the method, so the person running it did not need to understand the techniques.
The harness also scored each break-in like a game. A pivot into a separate internal network segment earned far more points than a single server shell, and security tools such as firewall consoles also scored high. At the time of recovery, the total was 3,725 points. That scoring shows the operator cared most about the systems that watch and divide a network.
Healthcare records were among the targets
The most serious finding involved healthcare data. Default login details reportedly gave the agent full database admin access to a TrakCare system running on an old Oracle 9i database. That exposed millions of records across patient, vaccination and appointment tables. The agent also pulled thousands of rows of subscriber billing and device data and took cryptographic keys from the telecom.
A caution in the report summary says those outcomes were not independently verified in the material available. The exact scale should be treated as the researchers’ claim for now. Even so, the root cause was basic because an unchanged default password opened the door.
A wider pattern of DeepSeek abuse
This case is not isolated. CrowdStrike said the China-linked group VAPOR PANDA used the ARTEX framework, mostly on DeepSeek, against more than 200 organizations in at least 14 countries over 11 days starting October 17. It confirmed access at nine organizations, where the group planted the BLOODALCHEMY backdoor. Telecom providers in the US, Belgium and the Philippines were also hit.
CrowdStrike’s Adam Meyers said human intruders usually run up to 40 commands an hour, while ARTEX activity passed 1,500. The speed changes the shape of the intrusion, since there is no human at the keyboard. Hunting for working-hours patterns or slow sessions will not help, and the activity is loud and repetitive.
Defensive clues and basic controls
Security teams are told to watch endpoint and network logs for fast scanning, bursts of failed logins and unusual tunnels. The basic controls listed in the report are to change every default password, especially on old database systems, keep internal network segments truly separate, place endpoint sensors on servers that seem unreachable from the internet, and monitor open directories and exposed storage. The report ends by saying AI did not create new weaknesses, but it found old ones faster than any team can patch them.
Licensed under CC BY-ND 4.0 International