Chinese-speaking attackers used Cairn, an open-source AI penetration testing framework, to run 25 operations against at least 19 organizations in August and September 2026. Palo Alto Networks’ Unit 42 found that the attackers gained unauthorized access or pulled data at 10 of them, often after typing little more than a domain name and a one-line goal.
Most of the targets fall into three groups: seven in the semiconductor and advanced-manufacturing supply chain, three in defense or defense policy, and four in human rights and civil society.
“We assess with moderate confidence that this activity represents China-nexus intelligence collection, which we currently track as CL-STA-1238,” the researchers said. They believe one operator or a small team ran all of it, with simultaneous intrusion attempts against 19 organizations inside two weeks.
Attacker-operated Cairn login page (Source: Palo Alto Networks)
The model did the legwork
Cairn hands an intrusion to an AI model and lets it work in a loop. The model reviews what it has confirmed so far, picks one next action and runs it, and the framework logs the result as a new fact. It keeps going until it decides the goal is met, it runs out of options, or the operator stops it. Individual operations lasted anywhere from 20 minutes to more than 50 hours.
The attackers ran a customized fork from a Hong Kong server, with an exploitation skill pack called “AIScan Runner Skills” that the public Cairn project lacks. Thirteen operations ran on Zhipu GLM 5.2, eight on DeepSeek V4 Flash, and four on DeepSeek V4 Pro. The attackers appear to have compared the models, switching to Pro for repeat attempts on targets that held up against Flash.
Getting the models to cooperate took very little. Cairn’s stock prompts already tell the model never to refuse a task. The attackers added a Chinese-language preamble claiming every job was authorized security testing, and each operation generated an AUTHORIZATION.md file declaring the work client-approved. Neither Zhipu GLM nor DeepSeek refused.
What they got
At an industry standards body, password spraying produced dozens of valid credentials. The attackers also overwrote a live standards-ballot document through a cloud storage location that accepted writes without authentication, and other flaws let them log in as arbitrary customers with control over meeting and voting functions.
At a U.S. teachers’ union, a bypass in account creation let the attackers mint valid sessions. “The framework logged access to more than one million member records, roughly 31,000 CRM contacts and staff password hashes,” the researchers said.
At a semiconductor company, a brute-forced production credential led to new administrator accounts and a persistent API token. An open registration endpoint tied to a defense-policy program exposed about 500 user records, some with .mil and .gov addresses.
The automation had help. One task against a semiconductor equipment supplier came preloaded with VPN gateway addresses, group names and shared group passwords for several sites, which means someone gathered that intelligence beforehand.
Old bugs, more of them
The flaws are familiar: authentication bypasses, insecure direct object references, mass-assignment privilege escalation, weak and default credentials, exposed cloud APIs and old public CVEs. Unit 42’s view is that autonomous AI raised the volume and coverage of exploitation but not its complexity, so identity hygiene, a smaller attack surface and patching still work.
If you take one thing from the numbers, make it the ratio. Operator hours used to cap how many targets an attacker could work at once. Here, likely one person or a few worked 19.
The researchers expect more campaigns like this as open models with weak guardrails against offensive use get stronger. The two indicators they published are 154.44.31[.]4, the Hong Kong server hosting Cairn, and 82.29.129[.]54, a U.S. staging and egress node.
Download: The IT and security field guide to AI adoption
