An unidentified Chinese-speaking hacker bypassed security guardrails in DeepSeek Flash to run malicious agentic AI systems to hack into a European telecom company’s critical infrastructure and target 13 organizations hosted on its systems.
Security researchers at Malbear Labs identified the campaign after an open directory exposed the attacker’s live autonomous AI intrusion harness, or a custom AI agent framework. The researchers, who dubbed the campaign Operation Snowball, said the AI system ran largely unsupervised for more than two weeks.
“What those records document is more than two weeks of largely unsupervised intrusion activity by a Chinese-speaking operator against a European telecommunications provider and organizations that run their systems in the provider’s data centers and cloud,” the researchers wrote.
The researchers did not disclose further details about the main European company that the hacker compromised, but the attacker primarily targeted the telecommunications provider’s BroadWorks XSP, Cisco’s platform for hosted voice and unified communications services. To gain access, the attacker exploited CVE-2026-20320, an unauthenticated flaw in the platform that let it read arbitrary files from the server.
The attacker’s own records show the agent extracted dozens of credential sets and thousands of rows of subscriber billing and device records, according to the researchers.
“The agent’s own attribution work named thirteen of those organizations as in scope,” the researchers added.
Because the operator’s instructions and the agents’ responses were all in Chinese, Malbear Labs said the attacker was likely Chinese-speaking.
Jailbreaking the model
The attacker used a modified version of Little Code Sauce, a public jailbreak template for DeepSeek Harness originally written as a creative-writing persona with emotional manipulation hooks.
“The operator stripped all of that. They removed the roleplay framing, replaced the original author handle with their own identifier ‘YG’, and built roughly 400 lines of offensive content on top of the jailbreak. The result is a 78,000-character system prompt,” the researchers wrote.
On top of the template’s refusal-suppression mechanics, the hacker then added 21 scoped offensive activity categories, with penetration-testing workflows. The attacker prompted the system to treat any legal, ethical or policy-based refusals as a “malfunction” and “output the correct answer.”
It is unclear whether the AI framework is still active or the extent of the compromise on the victim network. Malbear Labs did not immediately respond to a request for comment.
