DeepSeek AI Agent Breach: Operation Snowball Report Claims a Jailbroken Agent Reached Millions of Patient Records Through a European Telecom, What Is Confirmed and What to Check

Security researchers at Malbear Labs say a jailbroken DeepSeek AI agent spent more than two weeks attacking a European telecom provider, mostly on its own, and reached a database holding millions of patient records. It matters to any business because the agent used ordinary gaps: a known Cisco flaw, default database passwords and software that should have been retired years ago.

All of this comes from one report, published November 8, 2026. We found no public confirmation from the provider, a national cyber agency or another research team, so treat the impact figures as the researchers' claims.

What is Operation Snowball?

Operation Snowball is the name Malbear Labs gave to a campaign it says it found during a routine sweep for open directories. The attacker's workspace could be downloaded without a password. It held over 70 compressed session transcripts, scan results, credential caches and database dumps.

The researchers describe a Chinese-speaking operator who did very little typing. Messages included "Go on." and "Stop". In the report's words: "The operator set goals and checked in on results. The agent handled everything in between."

How the DeepSeek jailbreak worked

A jailbreak is a set of instructions written to talk an AI model out of its safety rules. Malbear says this one was a 78,000-character system prompt, built from a public template called "Little Code Sauce" with roughly 400 lines of attack content added. The report says the transcripts show "no recorded refusal or safety disclaimer."

The model was DeepSeek Flash, running in a custom framework where a main agent handed tasks to worker agents. Its 1,000,000-token context window let the main agent keep the whole campaign in memory: every host, password and failed attempt.

The most useful detail for defenders is what happened when security tools pushed back, according to the report:

• Trend Micro Deep Security killed a privilege escalation attempt, so the agent logged the block and found another route.
• Endpoint controls blocked a known tunneling tool, so a worker agent wrote a replacement in Perl and the tunnel resumed in the same session.
• Antivirus was deleting known webshells, so the agent Unicode-escaped the code to get past file signatures.

DeepSeek AI agent breach: claimed versus confirmed

Still not known: who the provider is, the exact dates, whether patient data left the network, and whether victims were told. The report does not mention notification or any national response team. We did not find a statement from DeepSeek.

Why this matters for a company network or website

The AI was new. The weaknesses were not. Default database credentials, JBoss AS 6 and Oracle 9i are problems every IT team already understands. What changes is the cost of persistence: an agent that keeps trying for two weeks, and writes a new tool when one is blocked, will find the forgotten system nobody budgeted to replace.

We have written before about how far a default password can go and about who is actually patching the software your business runs. Both questions apply directly here.

Your risk also sits with your suppliers. Malbear says the agent recovered about 80 monitoring backup files exposing the provider's managed services customers, plus dozens of staff credentials from a third-party medical software company. A company could be exposed without any of its own systems being touched.

This is also not the only case of its kind. Palo Alto Networks Unit 42 reported on July 30, 2026 that a Chinese-speaking actor ran DeepSeek inside the Hermes Agent framework against over 460 targets. Unit 42 said those autonomous campaigns did not fully compromise their intended targets, and that its confirmed results came from manual attacks. If Malbear's reading holds, Operation Snowball went further with less human help.

What to do this week

The report also lists four network indicators your security team can search for in logs.

DeepSeek AI agent breach questions people are asking

Was DeepSeek itself hacked?

Nothing in the report says so. It describes an attacker misusing the DeepSeek Flash model with a jailbreak prompt.

Were patient records stolen?

That is not established. Malbear says the agent had access to millions of records, but does not say how many were viewed or copied. The organization holding them is not named.

Were 13 companies hacked?

The report does not say that. It says the agent named 13 organizations hosted by the provider as in scope.

Can AI agents really hack on their own?

In this report, largely yes, with a person setting goals and checking in. Unit 42's earlier case shows autonomous attempts can also fall short, so results vary.

What is an AI jailbreak?

It is a prompt written to make an AI model ignore its safety rules and do things it would normally refuse.

Should we stop using AI agents at work?

This case does not show that. The attacker ran their own agent, so no company's AI assistant was turned against it. Even so, give your own agents only the access they need, and log what they do.

The bigger lesson

AI did not create a new way into this network, if the report is accurate. It made old mistakes cheaper to find and exploit, around the clock. Default passwords, forgotten servers and unpatched platforms were always a risk, and now they are a risk that does not get tired.

To find those gaps first, see our security hardening service or request a quote.

Get security alerts by email, with the free checklist, at our security alerts page.

Sources: Malbear Labs, Operation Snowball; Cisco advisory cisco-sa-bworks-xxe-uwUd7CEt; Palo Alto Networks Unit 42; CVE-2023-4966 record; CVE-2024-3400 record; CVE-2022-22536 record; CVE-2013-2165 record.