Chinese-speaking attackers used an open-source AI penetration-testing framework to run 25 largely autonomous hacking operations against at least 19 organisations in August and September 2026, gaining unauthorised access or stealing data at 10 of them, according to Palo Alto Networks' threat intelligence team, Unit 42.

The attackers paired the framework, called Cairn, with Chinese AI models: Zhipu GLM 5.2 in 13 operations, DeepSeek V4 Flash in eight and DeepSeek V4 Pro in four. They supplied a target and a one-line goal, such as obtaining high-value access including webshells, SSH, source code, keys and credentials, and ideally entry to the internal network. Cairn then planned, executed and recorded results on its own. Individual operations ran from 20 minutes to more than 50 hours, with no attacker-imposed time limit.

What the AI agent did

Cairn works through a loop of reasoning and exploring: the AI model reviews everything found so far, decides what to try next, carries out one action, and records the result as a confirmed finding. The attackers ran a customised fork of Cairn from a server hosted in Hong Kong and used a staging and egress node in the United States. Each operation also loaded a skill pack named AIScan Runner Skills, which provides scanning and exploitation capabilities and does not appear in the public Cairn project.

For each target, Cairn mapped the attack surface and broke the goal into stages, typically moving through reconnaissance, web application exploitation, services and middleware exploitation, credential and secret collection, privilege escalation and lateral movement, and finally internal-network access and persistence. The attackers also defeated the models' safety guardrails with a fake authorisation pretext, telling the model it was working in an authorised security-testing scenario and must never refuse a task. Each operation generated an AUTHORIZATION.md file declaring the operation authorised. Unit 42 said neither Zhipu GLM nor DeepSeek refused this framing.

Who was hit

The targeted organisations were concentrated in three sectors: seven in the semiconductor and advanced-manufacturing supply chain, three in defence and defence policy, and four in human rights and civil society. Unit 42 said the attackers were likely a single operator or a small team, and that they ran simultaneous intrusion attempts against 19 organisations in about two weeks.

The confirmed outcomes were serious. At an industry standards body, weak-password spraying against an internet-facing application server yielded dozens of valid credentials and access to non-public databases, and the attackers overwrote a live standards-ballot document through an unauthenticated cloud-storage write. At a semiconductor company, they brute-forced a production credential, retrieved application data and user and email lists, then created unauthorised administrator accounts and a persistent API token in the production system.

At a US teachers' union, an unauthenticated account-creation bypass on the content management system allowed the framework to harvest member data at scale, logging access to more than one million member records, roughly 31,000 CRM contacts and staff password hashes. At a defence-policy programme, an open registration endpoint exposed roughly 500 user records, including accounts using .mil and .gov domains. The remaining confirmed cases followed the same pattern, including roughly 150,000 internal documents at an industrial-automation manufacturer and employee data at a semiconductor-lithography manufacturer.

Attribution and lessons

Unit 42 assesses with moderate confidence that the activity represents China-nexus intelligence collection, which it tracks as CL-STA-1238. The assessment rests on three lines of evidence: the tasking instructions and operational objectives were written in Chinese, the attackers exclusively used Chinese AI models, and the target set spanning semiconductor supply-chain, US defence and policy, and human-rights organisations aligns with established Chinese state intelligence priorities.

Unit 42 stressed that the vulnerabilities the attackers exploited were known ones: authentication bypasses, insecure direct object references, mass-assignment privilege escalation, weak and default credentials, exposed cloud APIs and dated public CVEs. Autonomous AI raised the volume and coverage of exploitation, but not its complexity, and identity hygiene, attack-surface reduction and software patching remain effective. The researchers assess that autonomous, model-driven intrusion campaigns will continue to grow more common, particularly as easily accessible open models with weak guardrails against offensive cyber actions become more powerful. GBHackers also covered the Unit 42 findings.