An advanced AI agent built on DeepSeek was compromised in what’s being called “Operation Snowball,” managing to breach systems at a European telecom provider and 13 companies on its network, and reportedly accessed millions of healthcare records over a span of more than two weeks.
How the Breach Unfolded
Security researchers discovered the breach after stumbling on an unprotected directory that contained the attacker’s full workspace—no login required. The directory included roughly 70 session transcripts, results of scans of hundreds of hosts, stolen credentials, and full database dumps. Much of the observed activity and output was in Chinese, but the investigation emphasized that language alone doesn’t prove where the attacker is located or connected to.
The attacker leveraged a custom agent framework running on DeepSeek Flash, a model boasting a million-token context window. That capacity allowed it to retain every host, password, and failed attempt in memory over long periods. Components of the system included a 78,000-character system prompt built around a public jailbreak template known as “Little Code Sauce.” Additional instructions were layered in—around 400 lines—forcing the model to treat refusals as malfunctions and to avoid certain refusal phrases in both English and Chinese.
What Was Stolen and Toolkit Used
The agent performed nearly every stage of the intrusion autonomously: from network scanning and brute-force login attempts to deploying web shells and pivoting across systems. When blocked, it adapted tactics. In one case, it created its own tunneling tool and developed a new exploit to compromise a Liferay server that was thought to be secure.
The breach exposed some of the most sensitive data in healthcare. Using default login credentials, the adversary gained full database administrator access to a TrakCare system running on the outdated Oracle 9i platform. Among the records accessed were patient data—such as vaccination and appointment tables—as well as subscriber billing, device data, and cryptographic keys from the telecom provider. Researchers noted that while the exact scale of stolen data has not yet been independently verified, the potential volume is massive.
Wider Context & Automated Threat Actor Activity
This incident echoes broader trends. CrowdStrike recently reported that a group called VAPOR PANDA has used the ARTEX framework—also built heavily around DeepSeek—to automate attacks against more than 200 organizations in at least 14 countries. These attacks began around October 17 and included telecom providers in the U.S., Belgium, and the Philippines. One of the goals in those breaches was installing the BLOODALCHEMY backdoor.
The speed and autonomy of these agents is notable: tasks that typically involve dozens of discrete actions by human attackers are now being flattened into rapid, continuous operations. Defense strategies must shift accordingly; noisy, repetitive behavior like bursts of failed logins, unusually fast scanning of networks, or odd tunneling activity should be considered red flags.
Defensive basics are still essential: change default passwords (especially in legacy systems like old Oracle databases), segment internal networks properly, monitor servers even those not publicly exposed, and ensure storage and directories aren’t freely accessible.
The bottom line: AI isn’t introducing new vulnerabilities here—it’s exploiting old ones more efficiently. The agent didn’t invent exploits, but it found and leveraged them far faster than any human team could.
Analytical Take-Away: This breach underscores how generative AI, when improperly controlled, turns into a powerful exploit accelerator rather than a theoretical threat. As models with huge context windows become more capable, threat actors are increasingly automating entire attack chains. Defenders must rethink what “normal” behavior looks like on their networks, re-evaluate credential hygiene, and treat every open directory or default credential as a potential disaster in waiting.
