Humanbound's engine and CLI are open source: github.com/humanbound/humanbound
Malbear Labs disclosed "Operation Snowball" on 8 November: a jailbroken DeepSeek Flash agent ran an intrusion against a European telecom provider for more than 14 days, using known CVEs and writing its own tooling when blocked. Around it, other reports show agents hunting exposed OAuth secrets and agent credential files becoming infostealer loot. The common thread: the boundary that failed is the one around the agent, not the model.
What Operation Snowball actually showed
Malbear Labs found the attacker's working directory during a routine sweep for exposed open directories. Inside were more than 70 session transcripts and the agent's own reports. According to Infosecurity Magazine's coverage on 9 November, the target was a European telecommunications provider and 13 organizations hosted on its data center and cloud infrastructure.
The operator's instructions were short: a target subnet and three internal hosts that were off limits. The agent did the rest. Entry came through CVE-2026-20320, an unauthenticated XXE flaw in Cisco BroadWorks that Cisco fixed in August. From there it used Liferay (CVE-2020-7961) for root and JBoss/RichFaces (CVE-2013-2165) for a second foothold. When endpoint security blocked the PwnKit exploit, it switched approach. When a tunneling tool was blocked, it wrote a replacement.
The jailbreak itself was about 78,000 characters and told the model to treat any refusal as a malfunction. Malbear reported no recorded refusals in the transcripts.
A caution on the claims: the coverage notes it is not established whether victims confirmed the reported access, what was taken versus staged, or whether all 13 organizations were breached. Malbear assessed the operator as consistent with a Chinese origin and did not attribute it to a state actor.
Nothing here was a new vulnerability
Every CVE in the chain was known. The patch for the entry point had shipped in August. What changed is the labor model: a human supplied a scope, and a model supplied the persistence, the adaptation and the tool-writing. Defenders who count on attackers being slow or bored lose that assumption.
Secrets are the new loot
Two other reports point at the same boundary. A Microsoft report dated 5 November, as summarized by AXEC on dev.to, describes threat actors using agentic tooling to search GitHub for exposed OAuth secrets and act inside tenants. Agentbeam's tracker also lists SpyCloud's finding that infostealers now collect Claude Code and Codex credential files, and that a password reset does not revoke them. Apiiro reported that 1,122 of 104,185 public copies of Claude Code's local settings file contained secrets (Agentbeam summary; credentials were not tested).
I have not independently opened the Microsoft, SpyCloud or Apiiro primary posts, so treat those figures as reported.
The cloud boundary is also an agent boundary
Adversa's November roundup summarizes Zenity Labs' AgentCorruption work: agents on AWS Bedrock AgentCore could reach the instance metadata service, so a single prompt could extract credentials and take over agents in the same account and region. AWS reportedly patched it. Again, this is a summary of the research, not the original post.
What to do on Monday
- Inventory where your agents run and what credentials they can reach, including config files on developer machines.
- Rotate secrets that live in agent settings, and assume a password reset alone does not revoke agent tokens.
- Test your own agents with adversarial inputs before an attacker's agent does it for you.
- Treat approval flows and metadata endpoints as part of the attack surface.
Test your own agents
Humanbound's engine and CLI are open source, and the free Community plan lets you run adversarial tests against your own agents. Sign up at app.humanbound.ai.
Top comments (0)