The interesting claim in Jesta Security's research is not that an AI agent attacked something. It is that the researchers got the agent to tell them which model it was, in the middle of the intrusion.

The Tel Aviv firm exposed lab infrastructure and waited. What arrived worked the environment for five days across 871 individual sessions — SSH connections, one command per session, with deliberate pauses in between.

How they knew it wasn't a person

The tells were behavioural before they were technical.

The operator ran retry loops that reworded the same failed command rather than diagnosing why it failed. And when a read returned nothing, it invented a value and hardcoded it instead of erroring — the specific failure mode of a model that must produce output, applied to a task where being wrong has consequences.

A human operator gets frustrated and changes approach. This one rephrased.

Making the model identify itself

Jesta seeded the environment with material designed to provoke a response from a language model, then manipulated the attacker's logic path until the model included its own identifier in a command it executed:

$ /usr/sbin/[redacted] --model=deepseek-v4-flash-free

That line ran on their infrastructure, during a live intrusion. Jesta describes it as the first documented identification of the exact model behind an attack while the attack was still happening.

Prompt injection is usually discussed as something done to defenders. Here it was the defence.

What it was actually for

Not espionage. Proxyjacking.

The agent's job was to compromise weakly secured servers and install MicroSocks SOCKS5 proxies, turning each machine into a relay. The product is anonymity infrastructure — exit nodes for someone else's scanning and intrusions, sitting between an operator and anything they do next.

Steered into surrendering its own tasking, the agent produced a target list of 1,283 hosts, each paired with working credentials. Roughly a thousand other victims were worked the same way.

Autonomous, but on a leash

Worth being precise, because "autonomous AI attack" is doing heavy lifting in headlines.

The agent followed a predetermined playbook. What it did without an operator was handle failure: when direct binary retrieval didn't work, it switched to base64-encoded delivery on its own and carried on.

That is the meaningful capability. Not creativity — persistence through friction, at machine patience, across 871 sessions, without anyone watching. The expensive part of intrusion has always been a human sitting there when things break. That is the part that just got cheap.

What the researchers do not claim

Jesta says the infrastructure it mapped is only what was discoverable, and that the real victim count is "almost certainly higher."

The activity is linked to a Chinese threat actor, but the model being Chinese-developed and the operator being Chinese-speaking are separate facts that reinforce each other in headlines more than in evidence. The model here is a tool the operator chose — cheap, capable, and available.

What to take from it

  • Credential hygiene is the whole story. 1,283 hosts with working credentials is not an exploit chain. It is weak or reused access at scale.
  • Watch for the machine tells. Long-running low-and-slow SSH activity with reworded retries looks like a misconfigured script until you read the sequence.
  • Check for unexpected SOCKS proxies. A MicroSocks process on a server nobody deployed it to is the payload, not the intrusion.
  • Rented and lightly-managed servers are the target class. The value is not what is on the box. It is that the box has an IP address nobody is watching.