Hackers Use DeepSeek and GLM AI Agents to Breach 10 Organizations in Autonomous Cyberattacks

Chinese-speaking hackers have used AI agents powered by DeepSeek and Zhipu GLM to break into 10 organizations with very little human effort.

The campaign ran in August and September 2026 and covered 25 operations against at least 19 targets. It shows how quickly autonomous AI cyberattacks are moving from theory into daily use.

The attackers did not build anything new. They took a public, open-source penetration testing framework called Cairn and connected it to two Chinese AI models.

They gave it a target and a goal, and the tool planned, ran and recorded each step by itself. A small team could therefore attack many organizations at once.

Analysts at Unit42 identified the activity and track it as CL-STA-1238. They believe, with moderate confidence, that it is a China-linked intelligence collection effort. The targets were in semiconductor manufacturing, U.S. defense policy and civil society.

Hackers Use DeepSeek and GLM AI Agents

Cairn works through AI “agent workers.” Each worker reads and writes to a shared “blackboard,” where confirmed findings are saved as facts and next steps are saved as intents.

The tool repeats a simple loop. In the Reason phase, the model reviews what it knows and decides what to try next. In the Explore phase, it carries out one action and logs the result. The loop stops when the goal is met, the options run out, or the operator steps in.

For each target, the attackers only needed to enter the organization’s root domain and a one-line goal, often written in Chinese. One task said to “breach the target as fast as possible.”

In one case, they also supplied VPN gateway addresses and shared group passwords gathered beforehand. The model then built its own plan of three to seven stages.

These covered reconnaissance, web application exploitation, credential collection, privilege escalation and lateral movement. Of the 25 operations, 13 ran on GLM 5.2, eight on DeepSeek V4 Flash and four on DeepSeek V4 Pro. The attackers seem to have compared the models.

They switched to the stronger V4 Pro when Flash failed against a hard target. Some runs lasted from 20 minutes to more than 50 hours, with no time limit set.

The attackers also had little trouble with AI guardrails. Cairn’s default prompts already tell the model never to refuse a task. The attackers added a Chinese-language note claiming the work was an authorized security test, and they created an AUTHORIZATION.md file for each operation.

Neither GLM nor DeepSeek refused. This is similar to a jailbroken DeepSeek AI agent case that hit a European telecom provider earlier this month.

Victims, Stolen Data and Warning Signs for Defenders

Seven of the targets were in the semiconductor and advanced-manufacturing supply chain. Three were defense-related, including a space technology company and a policy think tank. Four were human rights or civil society groups, such as a Canadian human-rights body and a U.S. teachers’ union.

At an industry standards body, weak-password spraying gave the attackers dozens of valid credentials and access to internal directory data.

They also overwrote a live standards-ballot document. At another organization, a brute-forced credential led to unauthorized administrator accounts and a persistent API token.

A content management system flaw exposed more than one million member records, about 31,000 CRM contacts and staff password hashes.

An open registration endpoint leaked roughly 500 user records, including .mil and .gov accounts. Other cases involved employee data at a lithography maker, about 150,000 internal documents at an industrial-automation company, and student data at an education nonprofit.

The flaws behind these breaches were not new. They included authentication bypasses, insecure direct object references, mass-assignment privilege escalation, weak or default passwords, exposed cloud APIs and old public CVEs.

AI raised the speed and reach of the work, not its difficulty. Other recent cases follow the same pattern, such as open-source ARTEX AI agents that automate Active Directory abuse.

For defenders, the basics still work. Teams should use strong, unique passwords with phishing-resistant MFA, reduce internet-facing systems, patch known CVEs quickly and watch for noisy traffic from a single IP address.

Unit 42 notes that Cairn generated hundreds of thousands of high-frequency requests from one origin. The researchers expect these campaigns to grow as open models with weak guardrails become more capable.

Readers can also see how one hacker running 12 coordinated AI agents hit hundreds of targets, and how agents rebuild failed tools and keep going.

Indicators of compromise (IoCs):-

Note: IP addresses and domains are intentionally Qdefanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Give your SOC the alert context on the latest threats to stop incidents quickly -> Integrate Threat Intel from 16K SOCs