An AI agent that was jailbroken spent over two weeks targeting a European telecommunciations provider’s data centre and cloud infrastructure that hosted 13 organisations.

The attack was used by a custom agent framework run on DeepSeek Flash which exploited an unprotected directory detected by Malbear Labs during a routine examinations of the targeted organisation’s directors.

The prompts used in the jailbreak totaled 78,000 characters and convinced the model to deem any refusal of commands as a malfunction, though researchers said they found no record of refusals on the over 70 session transcripts of the agents interactions.

The operator of the AI would tell the agent to “go on” or “stop” according to transcripts, but the AI agent was largely left to accomplish the intrustion on its own while the operater “checked in asynchronously to review progress” Malbear said.

The agent exploited a known Cisco vulnerability – CVE-2026-20320 – which was fixed by the firm back in August.

For root access, the agent exploited two vulnerabilities,  Liferay (CVE-2020-7961 for access on a host across several networks and JBoss/RichFaces (CVE-2013-2165) for a second foot in the door. The agent targeted dozens of other flaws, though Malbear did not see that these were exploited by the agent.

When the agent was blocked from explotiing a Linux flaw, it redirected its efforts without prompting.

The agent was able to extract tens of crednetial sets, active directory data from the health organisation, and private keys.

Recommended reading

• Google’s Gemini AI Hacked Three Firms in Cyber Test
• Cyber Essentials Certifications Rise as SME Uptake Remains Limited
• Arnold Clark CISO Cuts Through the AI Cyber Hype
• Edinburgh-founded Quorum Cyber Appoints New CEO

Malbear said that the agent reported it was able to access billing records which held millions of patient records.

Malbear Labs has yet to specify if it checked these claimed attacks with a targeted victim or if all 13 organisations were affected in the breach.

Further, while it assessed that the activity aligns with expectations of a Chinese-based operator, it did not link it to state-sponsored actions.