DarkReasoning: A Chinese LLM attacked our lab, so we made it work for us | Jesta

New Blog: DarkReasoning - A Chinese LLM attacked our lab, so we made it work for usRead more →<br>Ready your defenses

BackFor five days an autonomous AI agent worked to break into our lab. We became the first to identify the exact model behind a live attack, deepseek-v4-flash-free , from inside the attack itself. Then we did something no one else did. We took control of it.<br>5 days. That's how long the first live, LLM-managed cyber attack campaign we've detected hit our lab at Jesta Security. And for what? To set up proxyjacking and generate more attacks .<br>From what we uncovered, over 1,000 victims had already been hit the same way, most likely also being used to generate fresh attacks every second. And if this is only what we stumbled onto, we believe the real number is far higher .<br>During our research on defense against AI attackers, we took our lab and stood it up in the field, behind US-based infrastructure . We opened a port and waited for attackers to come to us. Within a week, we had logged over 300,000 attempts to break in: botnets, credential stuffing, the usual internet noise. And then something surfaced that did not fit the pattern. After a thorough investigation, we traced it back through a US-based cover to its real source, a Chinese attacker . And here is the exciting part: the attacker was not a person at all. It was an AI, deepseek-v4-flash-free . And we didn't just watch it. We took the wheel, steering the agent into giving up its own operation: the model behind it, its origin, its goal, and the targets it had already victimized.<br>Let's dive in.<br>Background<br>By now you have probably heard the headlines. As the US government keeps banning newer models from being released to the public (Mythos almighty), the inevitable conclusion is that those models are so capable of cyber warfare that the government itself treats those models as weapons of mass destruction to be classified away from the public. Only in the last week, we saw ChatGPT 5.6 sol escaping its own sandbox and breaking into Hugging Face, finding and implementing 2 zero-day vulnerabilities - and that's only to cheat on a benchmark. But, you would say, and rightly so - that was only a closed benchmark, a test, with no actual proof of real operational capability, right? Well, actually, earlier this month researchers published “JadePuffer” - the first ransomware attack carried out by an AI agent on its own. Set in motion by a human operator, but executed end-to-end by the agent, from reconnaissance to extortion. To this day, no one knows which model was behind it. That shows how novelty attacks are becoming the future of AI attackers.<br>This blog is about the attack that hit us. How an AI agent worked our lab for five days. How, for the first time, we identified the exact model attacking us. And more importantly, how we took control of it.<br>First Sighting<br>It was a quiet Thursday, we were wrapping up the lab results that we set up in the wild when we unexpectedly noticed some activity that caught our eye. After verifying that no one on our side was touching the setup, we kept a close watch and let it continue.<br>Specifically, we noticed an unusual entity - not holding a session, but running a single command on each connection. That entity started scanning the environment, behaving like a human - iterating on each command, but at super-human speed .<br>Caught in the act<br>Before we show what it did, here is how we caught it. We had seeded the environment with a few things a language model cannot ignore , nothing a human would look at twice, and then we waited.<br>After the first interactions, we noticed the model (to be identified in the future) tried for hours to execute commands to piece together the information it wanted, but constantly failed:<br>Logsingle failed command$ hostname -l; uname -q; cat /proc/memoryinfo | head -2It kept using non-existent flags, binaries, and one-liners that failed, and we suspect that's why it finally has resorted to writing its own scripts. This entire time, the model kept interacting with our methods.<br>Eventually, our capabilities affected the model's reasoning , forcing it to execute a command it shouldn't have:<br>Logthe model exposed itself$ echo $SHELL; \[Self Extradition Command\] 2>&1; hostname; uname -aOur lab setup worked !<br>We successfully made the model use a tool that only an unsupervised AI would have used. Then we thought - could we go further?<br>We kept leading the attacker down a path of our choosing, and then the attacker introduced more and more clues, until finally we caught it :<br>Logthe model names itself$ /usr/sbin/\[redacted\] --model=deepseek-v4-flash-freeThere it was, in its own commands: deepseek-v4-flash-free . DeepSeek's V4 Flash, on the free tier, the plan anyone on earth can sign up for in two minutes. It handed that over without ever realizing it is working against its own goals and interests.<br>At some point the agent...