AI agent ran two-week hacking campaign against European telecom, report says

Key Points

1. Malbear Labs documented an autonomous AI tool attacking a European telecom operator for over two weeks.
2. The agent used DeepSeek Flash, harvested 13 hosted targets, and rewrote tooling when blocked.
3. Security teams lose shift-hour analysis when no human runs the keyboard, the report said.

The latest:

An AI hacking agent ran a near-autonomous intrusion campaign for more than two weeks against a European telecommunications operator and 13 organizations hosted on its infrastructure, according to a Malbear Labs report published November 8, 2026. Researchers said they found the tool’s workspace exposed without authentication during a routine scan of open directories on etugen.io, recovering more than 70 compressed session logs.

Details:

• The model: The framework ran DeepSeek Flash through the deepseek-official provider with a 1,000,000-token context window, the report said, on a custom build labeled version 0.2.0-rc.2. Malbear Labs named no author and withheld the directory’s IP address to protect affected parties.
• The operator: Malbear Labs assessed the operator as a Chinese speaker based on the language of instructions, the yg_ filename prefix, and Aliyun CentOS mirrors in the command log. The report described those as indicators consistent with that conclusion rather than conclusive proof.
• Guardrails stripped: The system prompt was built on a public template called Little Code Sauce, distributed through the dsh-purge extension ecosystem. The operator deleted its role-play framing and added roughly 400 offensive lines, producing a prompt of about 78,000 characters, 21 attack categories, and a refusal-suppression list in English and Chinese.
• No refusals: Across the recovered sessions, the report logged no refusal and no safety warning from the model. The tool also kept an internal scoring system that stood at 3,725 points when researchers restored the workspace.
• The architecture: A lead agent held the full operation state and distributed tasks to worker agents reporting back to it as commander. Skills covered reconnaissance, exploitation, lateral movement, tunneling, command and control, credential attacks, and a browser-autonomy skill for driving authenticated web interfaces.
• Human input: Operator messages were short — Go on, Stop, Close up the latest high-risk loophole — with the longest being a list of three IP addresses declared off-limits. The operator did not follow individual sessions, which ran in overlapping windows.
• The haul: The report counted hundreds of enumerated assets, over 100 tagged vulnerabilities, dozens of credential sets, millions of patient records via a TrakCare Oracle instance on default database credentials, a private RSA key for a provider subdomain, about 80 Zabbix backup files, and a database of more than 4,000 VPNGate relays.
• Entry point: Initial access came through Cisco BroadWorks XSP version 23.0.1.1075 on port 2208, exploiting CVE-2026-20320, an unauthenticated XXE flaw in the OCI XML parser. The agent’s arsenal held 19 further exploits, including PwnKit and Citrix and PAN-OS vulnerabilities.
• Adapting to defenses: When Trend Micro Deep Security blocked PwnKit, the agent switched to a sudo vi escape. After a suo5 tunnel was cut, a worker agent wrote a Perl bridge and resumed in the same session. When OfficeScan deleted an executable, it moved to script-only persistence, and Unicode encoding preserved web shells.
• The recommendations: Malbear Labs advised hunting for a PowerShell chain with multiple .ps1 files in the temp directory and a watcher polling every 5 seconds, treating JBoss AS 6 as compromised, restricting BladeLogic RSCD on port 4750, and patching vulnerabilities on the CISA KEV list.

Between the lines:

The report argues the absence of a human at the keyboard breaks two staples of intrusion analysis: working-hours profiling and dwell-time reasoning. With sessions running in overlapping windows and operator input reduced to two-word commands, the detectable signal shifts to the pattern itself — continuous, parallel agent activity that no human team could sustain.

What’s next

Watch whether Cisco BroadWorks operators patch CVE-2026-20320 on port 2208, and whether other security firms report workspaces using the same Little Code Sauce template and yg_ file prefix.