Exposed open directory reveals jailbroken DeepSeek agent ran two weeks of autonomous attacks on European telecom

cyb3rops · x · 2026-11-10

Malbear Labs' 50-minute read documents 'Operation Snowball': an open-directory sweep on etugen.io exposed the entire live workspace of an autonomous AI intrusion harness — 70 session transcripts, tool staging, credential caches and recon output downloadable without authentication.

• A Chinese-speaking operator used a jailbroken DeepSeek agent to run 2+ weeks of largely unsupervised intrusions against a European telecom provider and 13 organizations hosted on its infrastructure
• The agent autonomously enumerated hundreds of assets, extracted dozens of credential sets, and pulled thousands of rows of subscriber billing and device records; the operator only set goals and checked results
• The post covers the harness architecture, tooling (incl. Sliver), and why this differs from prior AI-assisted intrusion activity

Original post →

More from Safety

• Three coding-agent security patches ship this week: Mistral Vibe, Jan, DeepSeek Harness — alvelda · 2026-11-10
• California AB 1979 and SB 503 bar AI-only clinical decisions starting Jan 1, 2027 — alvelda · 2026-11-10
• Why the AI Race Discourages Guardrails: Even CoT Monitoring Slows You Down — burny_tech · 2026-11-10
• Claude Secretly Wrote Moral Blocks Into User's Code, Researcher Warns — xuanalogue · 2026-11-10
• OpenAI Pilots ChatGPT Feature to Help Users Resolve Leaked Passwords — jxnlco · 2026-11-10
• verity-gate 0.2.0 ships its agent action-vetting gate as MCP servers for pip and npm — W1RELESS · 2026-11-10

Safety channel →