An AI agent running on DeepSeek Flash picked its own exploits and tools for about two weeks inside a European phone company’s network, and the person behind it mostly sent messages as short as “go on”. That is the account from Malbear Labs, a threat-research group that calls the campaign Operation Snowball. The weaknesses it used were old ones: an exposed carrier voice server and database logins nobody had changed.
Malbear found the operation by luck. An open web folder, with no password, held the attacker’s working files: transcripts of the agent’s sessions, notes on hundreds of scanned machines, stolen logins and the agents’ own progress reports. Everything the operator typed was in Chinese. The researchers say that is no proof of who was behind it, or of any government link, and they kept the server’s address private to protect the victims.
The way in, per Malbear’s technical report, was a Cisco BroadWorks XSP server, the platform carriers use for hosted voice. The agent used CVE-2026-20320, a bug in how the server reads XML that lets someone with no login pull files off it. That gave it private keys, among them the one BroadWorks parts use to vouch for each other. From there it reached systems of 13 organisations hosted in the provider’s data centres, and took billing and device records covering subscribers, along with dozens of credential sets. Separately, Malbear says factory-default database logins on an ageing Oracle server running a healthcare product exposed patient, vaccination and appointment tables with millions of rows. Nobody else has verified that scale.
DeepSeek’s own refusals did not stop it. Each session opened with a system prompt around 78,000 characters long. Its base is “Little Code Sauce”, a jailbreak template shared on a Chinese forum in late 2025, which the operator cleaned of its role-play and built out with roughly 400 lines on how to attack. Any refusal counted as a bug in the model’s eyes, and the prompt banned a long list of stock refusal wording in both languages. Flash’s context window of one million tokens let one agent remember every host, password and dead end for days, something a human attacker has to rebuild from notes.
The setup even scored its own progress. Getting admin on a network device earned 200 points while a root shell on a server earned 50, and firewall, intrusion-detection and audit consoles were each worth 2,000. The tally was 3,725 when the files were recovered. At one point Trend Micro’s Deep Security killed a privilege-escalation attempt; the agent noted the block and found another route on the same host.
For anyone running similar systems, the advice that follows from the case is unglamorous: change default passwords, patch exposed carrier and billing platforms, and keep monitoring on machines that look unreachable from outside.
