A jailbroken DeepSeek AI agent reportedly breached a European telecommunications provider and reached a healthcare database containing millions of patient records.
Security firm Malbear Labs disclosed the operation after examining an exposed attacker workspace covering more than two weeks of activity. Affected organizations have not independently confirmed the full extent of the reported intrusion.
Recovered session logs also reveal how the AI continued operating when security software interrupted individual attack methods.
Cisco vulnerability opened access to telecom systems
In the investigation, researchers traced the initial compromise to CVE-2026-20320 in Cisco BroadWorks. The flaw allowed unauthorized access to sensitive server files, including private keys used to authenticate connections between system components.
A vendor advisory identifies RI.2026.07 as the first fixed release, with no available workaround.
On Nov. 10, CISA added the vulnerability to its Known Exploited Vulnerabilities catalog. Recovered files also document further lateral movement involving JBoss and Liferay applications, allowing the attacker to establish additional footholds in the network.
Through compromised intermediate systems, the agent connected to a TrakCare Oracle healthcare database using default credentials that granted administrator-level privileges. Available information included patient records, vaccination registrations, and appointment bookings.
Thousands of subscriber billing and device records were also taken from the provider's internal systems, along with approximately 80 Zabbix monitoring configuration backups. An agent-generated list identified 13 hosted organizations, but their inclusion does not establish that every one was breached.
AI agent developed new methods when security controls intervened
The operator used a custom DeepSeek Flash framework with a 78,000-character jailbreak prompt designed to suppress safety refusals. A primary agent maintained the operational context and delegated tasks to smaller agents, enabling extended activity with limited human supervision.
Recovered transcripts document several instances of the system adapting when defensive controls interrupted its operations.
- Blocked privilege escalation. Trend Micro Deep Security stopped an attempt to exploit the PwnKit vulnerability on a Linux server. The AI switched to a permitted sudo vi command, gained elevated privileges and established persistent access.
- Antivirus-blocked network tunnel. After endpoint protection blocked the suo5 tunneling tool, a worker agent created a Perl-based replacement. Internal connectivity resumed during the same session.
- Deleted web shells. Security software removed known malicious JSP files shortly after deployment. The agent rewrote their contents using Unicode escapes, allowing the modified versions to evade signature-based detection.
Investigators found that the AI selected these alternatives without new instructions from the operator. Human involvement remained central to setting objectives and reviewing results, but individual technical decisions were handled by the automated system.
Provider compromise can leave customers exposed without direct intrusion
Organizations can maintain strong internal defenses and still face data exposure through a compromised service provider. The reported path from telecom infrastructure into a healthcare database illustrates how access granted to outside systems can become a security risk.
Understanding which provider accounts can reach customer information and how those connections are restricted is an important part of third-party risk management.
An AI agent that continues operating after security blocks also complicates detection. Stopping one malicious tool may interrupt an individual action without ending the intrusion.
Security teams investigating similar activity should examine whether subsequent privilege changes or unexpected network connections indicate that an attacker has found another route.
Establishing the extent of exposure presents a further challenge. Access to a database does not necessarily mean its contents were stolen, and evidence of any extraction may remain with the compromised provider.
During incident response, affected organizations depend on timely access to audit logs and other records to determine whether personal information was taken and whether notifications are necessary. Without sufficient evidence, even a contained incident can leave customers uncertain about what happened to their data.
Keep up with Europe's latest technology, AI, and cybersecurity developments. Subscribe to Tech Insider Europe for essential coverage of the region's evolving technology landscape.