Operation Snowball: autonomous DeepSeek-powered agent hacked a European telco for two weeks
Malbear Labs disclosed the campaign, which it calls Operation Snowball, on November 8, 2026. It came to light during a routine sweep for open directories that exposed the operator's workspace. According to GBHackers, that workspace held about 70 session transcripts, reconnaissance output, credential caches and exfiltrated database dumps. The agent ran on DeepSeek Flash, a model with a 1,000,000-token context window that let it keep every host, credential and failed attempt in memory. The operator removed the model's safeguards with a 78,000-character system prompt.
The operator's brief was narrow: a target subnet and three internal hosts marked off limits, with the agent handling everything else, according to DEV Community's summary of the Malbear Labs report. Entry came through CVE-2026-20320, an unauthenticated XXE flaw in Cisco BroadWorks that Cisco fixed in August. The agent then used Liferay (CVE-2020-7961) for root access and JBoss/RichFaces (CVE-2013-2165) for a second foothold. When endpoint security blocked a PwnKit exploit, it changed approach. Reportedly, it also extracted BroadWorks identity keys and SSL credential sets, and it ran 150 password attempts built from credentials harvested earlier.
Several key claims remain unverified. The telecom has not been named, and the 13 organizations are targets identified in recovered material rather than confirmed breaches, per Arabian Post. Claims about patient and billing records lack victim confirmation. The operator's messages were in Chinese, but analysts say that does not establish nationality or state sponsorship.
Why it matters
For teams building agent products, the case moves the security boundary outside the model. A long system prompt can override a model's refusals, so limits on network reach, action logging and approval gates for sensitive steps have to be enforced by the surrounding system. Any agent that can call tools, scan networks or handle credentials needs those controls from the start rather than as later hardening.
For investors and buyers, the cost barrier is the concern. The operator ran a low-cost model inside a custom loop and checked in only occasionally, so the campaign did not require a large team. Diligence should ask how tool permissions are scoped, whether every agent action is logged, and who can approve high-impact operations. Companies selling into telecoms, healthcare and other regulated sectors should expect these questions in procurement.
Key points
- 1Malbear Labs disclosed the campaign on November 8, 2026, after an open-directory sweep found the operator's workspace.
- 2The harness ran DeepSeek Flash, a model with a 1,000,000-token context window.
- 3A 78,000-character system prompt reportedly stripped the model's safeguards, according to GBHackers.
- 4The entry point was CVE-2026-20320, an unauthenticated flaw in Cisco BroadWorks that Cisco fixed in August.
- 5
