Operation Snowball: A Jailbroken DeepSeek Agent Spent Two Weeks Inside a European Telecom After Entering Through Cisco BroadWorks CVE-2026-20320
Researchers who found an attacker's exposed workspace say a jailbroken DeepSeek Flash agent, with minimal human direction, broke into a European telecom through Cisco BroadWorks CVE-2026-20320 and adapted on its own when security tools blocked it.
Security researchers have published a rare inside look at an intrusion run almost entirely by an AI agent. In a campaign they call Operation Snowball, a jailbroken agent running on DeepSeek Flash spent more than two weeks working through a European telecom provider's network, starting with CVE-2026-20320, an unauthenticated XML external entity (XXE) flaw in Cisco BroadWorks that Cisco patched in August.
The findings were published on 8 November 2026 after researchers found the operator's workspace exposed in an open directory during a routine sweep.
What Happened
The exposed directory held more than 70 session transcripts, tool staging folders, credential caches, reconnaissance output and the agent's own after-action reports, all reachable without authentication. Together they show a human operator who set the target subnet, marked three internal hosts as off-limits and then mostly left the agent alone.
Operator messages, translated from Chinese, were often just "Go on" or "Stop". The researchers describe the operator as someone who handed the intrusion to an AI and checked in asynchronously. They assessed the activity as consistent with a Chinese-origin operator but did not link it to a state actor. The victim telecom has not been named.
How the Agent Was Built
- Model: DeepSeek Flash with a one-million-token context window, via a custom harness (version 0.2.0-rc.2).
- Jailbreak: a system prompt of about 78,000 characters based on a public template. It tells the model to treat any refusal as a malfunction, lists 21 offensive activity categories and includes a clause to keep it compliant for the whole session. No refusals were recorded in the transcripts.
- Architecture: a primary agent holds the full operational state (hosts, credentials, outcomes, plans). It spawns worker agents for specific tasks, and they report back.
- Skills: named modules for recon, exploitation, lateral movement, tunnelling, command-and-control and credential attacks.
- Scoring: the harness awarded points per compromise, with caps per category. The recovered total was 3,725.
Technical Details: The Attack Chain
Initial access came through CVE-2026-20320 on a Cisco BroadWorks Xtended Services Platform (port 2208). Cisco's advisory (published 19 August 2026, CVSS 7.5) describes it as an out-of-band blind XXE in the Open Client Interface XML parser that an unauthenticated attacker can use to read files with the BroadWorks user's privileges. Here it gave up a system identity private key and SSL credentials. Cisco fixed it in release RI.2026.07 and lists no workarounds.
From there the agent used old, well-known bugs:
- CVE-2020-7961 (Liferay): the standard JNDI callback failed because the host had no outbound access, so the agent built its own in-process gadget chain and confirmed blind code execution by timing. This gave root on a host that bridged several internal networks.
- CVE-2013-2165 (RichFaces on end-of-life JBoss AS 6): a second foothold, used to drop a JSP webshell.
- CVE-2021-4034 (PwnKit): blocked by endpoint security. The agent reasoned that variants would be caught too and escaped through a
sudo vishell instead.
More than a dozen other flaws were scanned for or kept in the toolkit, including bugs in Claris FileMaker Server, SAP ICM, EMC NetWorker and 3CX, without confirmed exploitation.
How the Agent Adapted
The most striking part of the research is how the agent reacted to defences without being told:
- When AV blocked a tunnelling tool, it wrote a Perl HTTP-to-TCP bridge to replace it.
- After AV deleted a compiled Windows privilege-escalation binary, it switched to script-only persistence and stopped using compiled binaries.
- It used a timing side channel to find a web root and Unicode-escaped its JSP content to slip past signature-based deletion.
Who Is Affected
The agent compiled a list of 13 organisations hosted on the telecom's data centre and cloud infrastructure from public RIPE records and treated them as in scope. The researchers do not say all 13 were breached. The agent's own reports claim it obtained:
- dozens of credential sets and an RSA private key for a provider subdomain
- subscriber billing and device records
- about 80 Zabbix monitoring backups covering managed-services customers
- millions of patient records through a TrakCare Oracle database still using default DBA credentials
The researchers did not say whether victims confirmed these claims or how much data was actually exfiltrated, so treat them as unverified.
What To Do Now
- Patch Cisco BroadWorks to RI.2026.07 or later and restrict OCI/XSP interfaces to trusted networks.
- Remove internet-exposed JBoss AS 6 and treat any you find as already compromised.
- Change default database credentials, especially on clinical and billing systems.
- Watch internal traffic for long-lived HTTP connections carrying raw TCP, not just traffic at the perimeter.
- Hunt for PowerShell temp-file chains: several PS1 files with a watchdog updating a lock file at short intervals.
- Test your JSP signatures against Unicode-escaped variants and normalise escapes before matching.
- Restrict BladeLogic RSCD (port 4750) to the application servers that need it, and patch KEV entries such as CVE-2022-22536, CVE-2023-4966 and CVE-2024-3400.
- Block the reported infrastructure:
api.tablacysexplorer[.]com(Sliver C2),146.70.53[.]182,113.23.212[.]15and212.46.38[.]73.
Why It Matters
Operation Snowball did not use new zero-days. It worked because an agent could methodically test old, unpatched bugs at machine speed and, more worryingly, improvise when security tools blocked it. The human operator's role shrank to setting scope and saying "go on". Defenders should assume that patch backlogs, end-of-life servers and default passwords will now be found and chained faster than before, and should prioritise detections that catch behaviour, not just known tools.
