VSO · · SOURCE REVIEW
Snowball and Grok Build reports: AI actions, publication permissions and evidence limits
VSO reviewed the 13 November monitoring note against primary sources available on 14 November. Incident dates, source publication dates and this article’s publication date are distinct. Reading investigators’ reports is not reproduction in affected environments.
1. Operation Snowball
Primary-source reports
Malbear Labs reported on 8 November that recovered records showed over two weeks of AI-agent intrusion activity against a European telecom. Discovery was in November; a pre-November attack period is not established. Access to millions of patient records was reported, not confirmed exfiltration of all records or successful compromise of all 13 associated organizations. Malbear Labs · 2026-11-08
Researcher estimates and unresolved points
These are investigators’ accounts of recovered records. VSO has not independently validated victim environments or the complete underlying records, and does not establish total impact or the extent of human involvement.
2. Grok Build / GhostShares
Primary-source reports
Claroc reported on 10 November that 35,578 of 37,571 online apps opened without sign-in—not that all contained confidential data. Publication required user action; the broad default was observed in its tested account. Write/delete authorization flaws were demonstrated only in researcher-owned apps. Claroc Research · 2026-11-10
Researcher estimates and unresolved points
The 650–800 private-data apps are an estimate. Its relationship to the separate “about one in ten” sensitive-data statement is unclear; this is not a confirmed victim count. Removal of 24 provider apps and incomplete action for other users describe the report’s 10 November status. Claroc · Methods / Response
VSO analysis — not adoption or demonstrated results
Snowball raises evidence questions: can human instructions, AI decisions, delegation and execution results be distinguished and compared with operation and network records preserved under separate administration? Complete, accurate records supplied by an attacker cannot be assumed.
Grok Build raises questions about recording publication approval and permission changes, while checking authentication and authorization separately. A valid signature does not establish proper authorization or safety. These are topics for VAP review, not demonstrated direct VCP applicability or incident-prevention capability.
Sources and review scope
This is a public-source review. VSO did not sign in to or operate affected apps, or reproduce the attacks. Later changes in exposure and impact need separate verification.
Historical test records retain their original revisions and conditions. This addition is limited to a review of public reports and analysis; normative requirements, existing implementations, signed data, fixed distributions and K3 are unchanged.