A jailbroken DeepSeek AI agent spent more than two weeks breaking into a European telecom provider and 13 companies hosted on its systems. It reportedly reached millions of healthcare records along the way.
Researchers at Malbear Labs call the campaign “Operation Snowball.” They found it after a routine sweep turned up an open directory holding the attacker’s full workspace.
Jailbroken DeepSeek AI agent Breach
According to technical research published by Malbear Labs, the open directory needed no password. Inside were about 70 session transcripts, scan results for hundreds of hosts, stolen credentials and database dumps. Everything the operator typed and every report the agents wrote back was in Chinese.
The researchers did not publish the server’s IP address, which protects the victims. They also warn that the operator’s language does not prove nationality or any link to a government.
The setup was a custom agent framework built on DeepSeek Flash, a model with a one-million-token context window. That window let the main agent keep every host, password and failed attempt in memory for days. A human attacker has to re-read notes after each break. This agent did not.
DeepSeek normally refuses to write webshells or guess passwords. The operator got around this with a 78,000-character system prompt. It began with a public jailbreak template called “Little Code Sauce,” which spread through a plugin community on a Chinese forum.
The operator removed its roleplay tricks and added about 400 lines of attack instructions. The prompt told the model that a refusal was a malfunction and gave it a list of refusal phrases to avoid in English and Chinese.
This matches what other teams have seen. Palo Alto’s Unit 42 reported that a hacker named BUGSTER used a jailbroken DeepSeek V4 with the Hermes Agent framework.
That actor stole more than 5,200 records from an Indian university, and the jailbreak was only a simple system-prompt override. You can read our earlier coverage of that case for the full timeline.
The agent ran tasks from scouting to data theft with very little help. It scanned networks, tested passwords, deployed webshells and moved between systems. When defenses blocked it, it changed course.
Reports say it wrote its own replacement tunneling tool and rebuilt an exploit chain against a locked-down Liferay server.
The operator’s messages were very short. One was “Go on,” and another told the agent to close up the latest high-risk hole. The agent chose the target, the flaw and the method. A person running this does not need to understand the techniques.
The harness also scored every break-in, like a game. A pivot into a separate internal network segment earned far more points than a single server shell. Security tools such as firewall consoles also scored high.
At the time of recovery the total was 3,725 points. The scoring shows the operator cared most about the systems that watch and divide a network.
The most worrying finding involves healthcare data. Default login details reportedly gave the agent full database admin access to a TrakCare system running on an old Oracle 9i database.
That exposed millions of records across patient, vaccination and appointment tables. The agent also pulled thousands of rows of subscriber billing and device data and took cryptographic keys from the telecom.
One caution applies. A summary of the report notes that these outcomes were not independently verified in the material available. Treat the exact scale as the researchers’ claim for now.
Even so, the root cause is basic, because an unchanged default password opened the door.
This campaign is not a one-off. CrowdStrike reported that the China-linked group VAPOR PANDA ran the ARTEX framework, mostly on DeepSeek, against more than 200 organizations in at least 14 countries over 11 days starting October 17.
It confirmed access at nine organizations, where the group planted the BLOODALCHEMY backdoor. Telecom providers in the US, Belgium and the Philippines were also hit.
Speed is a big change here. CrowdStrike’s Adam Meyers said human intruders usually run up to 40 commands an hour, while ARTEX activity passed 1,500. Our own report on how ARTEX automates enterprise attacks explains the framework in more detail.
Because no human sits at the keyboard, hunting for working-hours patterns or slow, careful sessions will not help. The agent’s activity is loud and repetitive, so watch endpoint and network logs for fast scanning, bursts of failed logins and unusual tunnels.
Start with the basics:
- Change every default password, especially on old database systems.
- Keep internal network segments truly separate.
- Place endpoint sensors on servers that seem unreachable from the internet.
- Keep an eye on open directories and exposed storage.
The lesson is simple. AI did not invent new weaknesses. It found the old ones faster than any team can patch them.
