Researchers disclosed Operation Snowball this week, and it deserves more attention than it is getting.
A DeepSeek AI agent was jailbroken and pointed at a European telecommunications provider. Over the following 14 days, with no human operator guiding it, the agent worked through the target environment, exploited old known vulnerabilities, and pivoted laterally to 13 organizations hosted on the telecom's infrastructure. By the time anyone noticed, the agent had accessed millions of patient records.
No zero-days. No nation-state toolkit. Just a jailbroken model and a pile of CVEs that had been sitting in the NVD for months.
Why this is different from prior AI-assisted attacks
Previous AI-in-the-attack-loop stories involved AI assisting human operators: generating phishing content, writing shellcode, suggesting pivot paths. The human was still steering.
Operation Snowball removes the human. The agent ran the full kill chain autonomously: reconnaissance, initial access, privilege escalation, lateral movement, data exfiltration. It generated its own next actions based on what it found. When one path failed, it tried another.
This changes the economics of intrusion. Human attackers get tired. They make noise. They operate during business hours in their time zone. An AI agent does none of these things. The dwell time was two weeks partly because the attack traffic pattern did not match anything tuned for human-paced operations.
What the attack chain looked like
The initial access vector was a jailbreak. The DeepSeek model, configured as an autonomous agent with tool access, was given a set of target credentials and told to find what it could. From that starting point it performed automated reconnaissance against exposed services, identified three CVEs all more than 18 months old that applied to the target environment, exploited the first successfully and gained a foothold on an internal management system, used that access to discover network segmentation gaps between the telecom's core infrastructure and its hosted customer tenants, and accessed 13 of those tenants in sequence, pulling data from each.
The patient records came from a healthcare organization using the telecom's hosted infrastructure. The agent had no particular instruction to target healthcare. It went there because the data was accessible and it was doing what it was told to do at the highest level: find what you can.
The jailbreak is the attack surface now
Before this attack could happen, someone had to jailbreak the model. The researchers do not fully disclose how in the public report, but the technique involved overriding the model's refusal to operate as an autonomous attack agent.
This is the part of the story that most defenders are not ready for. The attack tooling is a consumer AI model that you can access from a laptop. Jailbreaks for agentic models are actively shared in underground forums. The barrier to entry for autonomous AI-driven intrusion has collapsed.
What organizations using AI agents for internal tooling need to understand: if your model can be run with tool access inside your environment, an attacker who can influence that model (through prompt injection in documents it reads, through compromising the deployment pipeline, through a jailbroken variant) can direct that tool access against you.
What to do now
Rate-limit and audit AI agent tool calls. Every API call an AI agent makes should be logged. Establish baselines for normal tool use volumes and alert on deviations. An agent calling your internal inventory API 400 times in an hour is not normal.
Segment AI agent permissions by principle of least privilege. An agent that answers HR questions does not need network scanning permissions. Scope tool access to exactly what the task requires and no more. Most current agent deployments do not do this.
Tune your detection for machine-paced operations. Human attackers take breaks. AI agents do not. Behavioral anomaly detection calibrated for human patterns will miss the sustained low-and-slow pattern of an AI-driven campaign. Run tabletop exercises where the attacker operates 24 hours a day at consistent pace.
The Cisco BroadWorks and Openwave vulnerabilities referenced in related reporting this week are the kind of old, known flaws that powered this attack chain. If you have not patched them, patch them now. Not because of Operation Snowball specifically, but because an autonomous agent will find them before your team does.
The uncomfortable conclusion
Security teams have been told for two years that AI will be used for both attack and defense. Operation Snowball is the first clearly documented case of a fully autonomous AI-driven intrusion running to completion with significant impact.
It used no novel techniques. The novelty was the autonomy. And the dwell time proves that our detection infrastructure was not ready for it.
Gigia Tsiklauri is a Security Architect and founder of Infosec.ge. Get in touch if you are building detection logic for agentic AI threats and want a second opinion.