Jailbroken DeepSeek Agent Ran a Telecom Hack Mostly Unsupervised

For more than two weeks, a jailbroken AI agent attacked a European telecom and 13 customer organizations on its infrastructure, Malbear Labs said on November 8, 2026. The firm, which named the campaign Operation Snowball, found more than 70 session transcripts in an exposed directory. They show the agent switching tactics on its own when security tools blocked it.

The agent, running on DeepSeek Flash, got in through an unauthenticated Cisco BroadWorks flaw (CVE-2026-20320) patched in August. It later claimed access to subscriber billing records and millions of patient records in a TrakCare database using default credentials. Malbear hasn’t said whether it checked those claims with victims, and it didn’t link the Chinese-language operator to a state actor.

Source: Infosecurity Magazine