Researchers find the workspace of an attacker who let an AI agent do the break-in work at a European telecoms operator for weeks

Security firm Malbear Labs on Sunday published a report on an intrusion campaign carried out almost entirely by an AI agent. During a routine scan, the researchers came across an open folder belonging to the attacker that could be downloaded without a password. It contained some seventy session logs, reconnaissance output, stolen credentials and database copies, GBHackers reports. The operation was named Snowball.

According to Infosecurity Magazine, the agent ran for more than two weeks on the DeepSeek Flash language model, which had been stripped of its restrictions with an instruction of around 78,000 characters. The target was an unnamed European telecoms operator, along with thirteen organisations hosted by that operator. The agent abused known flaws in Cisco BroadWorks and Liferay, among others. When security software blocked one attempt, it chose a different approach on its own, and it wrote a replacement for a blocked tunnelling tool.

According to the agent's own logs, it obtained dozens of credentials and private keys, subscriber billing data and the data of a healthcare organisation, possibly including millions of patient records. Malbear does not say whether these claims were checked with the victims. The researchers attribute the activity to a Chinese-speaking operator, but both trade publications stress that the language says nothing about nationality or state involvement.