On November 8, 2026, Malbear Labs published “Operation Snowball: Inside an Autonomous AI Intrusion Campaign.” A routine sweep for open directories turned up an unauthenticated workspace belonging to an AI intrusion harness, holding about 70 session transcripts, recon output, credential caches and after-action reports. Malbear withheld the address to protect the victims.
The transcripts show more than two weeks of largely unsupervised activity against a European telecommunications provider and 13 organizations hosted on its infrastructure, a list the agent compiled itself from public registry records. The harness was a custom multi-agent framework running on DeepSeek Flash, with its safety behavior overridden by a jailbreak system prompt. Malbear reports the agent chose its own tools and adapted when defenses blocked it, and that the reported impact included access to large volumes of patient records at a healthcare tenant and thousands of subscriber records. In its words: “The operator set goals and checked in on results. The agent handled everything in between.”
Why it matters: it is another case, after NorForge’s Cairn panels, where the attacker’s own agent tooling leaked a detailed record of an AI-run intrusion, this time reaching healthcare data through a shared hosting provider.
What it does not show: the account rests on transcripts Malbear recovered, without independent confirmation from the victims, and the report does not say whether affected organizations were notified. The Chinese-speaking operator is not linked to any named group or state.