A Chinese-speaking hacking operation handed an open-source AI penetration-testing framework a target and a one-line goal, then let it run. Over August and September 2026, the framework, called Cairn, carried out 25 operations against at least 19 organizations and confirmed unauthorized access or data retrieval at 10 of them, Palo Alto Networks' Unit 42 reports.
The haul included dozens of valid credentials, more than one million personal records at a single organization, military and government identities, persistent administrator accounts in a production system, and an edit to a live industry standards-ballot document. Unit 42 tracks the activity as CL-STA-1238 and assesses with moderate confidence that it is China-nexus intelligence collection.
Give it a goal and the agent plans the break-in
Cairn coordinates AI "agent workers" through a shared blackboard: confirmed findings are recorded as facts, next steps are queued as intents, and a human operator can drop in hints at any time. For each operation the attackers wrote a goal in Chinese, which Unit 42 translates as "Obtain substantive high-value access, including but not limited to webshell, SSH, source code, keys, user information, credentials, ideally, to enter the internal network." The model then drew up its own plan of three to seven stages per target and looped between reasoning and single actions until it judged the goal met, ran out of options, or was stopped. Operations ran from 20 minutes to more than 50 hours.
The attackers ran a customized fork from a server in Hong Kong and used Chinese models throughout: 13 operations on Zhipu GLM 5.2, eight on DeepSeek V4 Flash and four on DeepSeek V4 Pro, which they appear to have saved for repeat attempts on targets that resisted the Flash model. Each run also loaded a skill pack called "AIScan Runner Skills" that does not exist in the upstream project.
A one-paragraph jailbreak was enough
Cairn's stock prompts already tell the model never to refuse a task. The operators added a Chinese preamble declaring every task an authorized security test, CTF or audit, and generated an AUTHORIZATION.md file for each operation. Unit 42 says neither Zhipu GLM nor DeepSeek refused that framing.
Chip suppliers, defense policy and civil society
Seven targets sat in the semiconductor and advanced-manufacturing supply chain, spanning lithography, chip design, materials, photomasks and standards. Three were in defense and defense policy, and four in human rights and civil society, including a Canadian human-rights body and a U.S. teachers' union. At the union, an account-creation bypass in the content management system let the framework log access to more than one million member records, about 31,000 CRM contacts and staff password hashes. An open registration endpoint at a defense-policy program exposed roughly 500 user records, including .mil and .gov accounts. At one semiconductor company the agent brute-forced a production credential, then created rogue administrator accounts and a persistent API token.
Not all of it was autonomous scouting. One task against a semiconductor equipment supplier was seeded with VPN gateway addresses, group names and shared group passwords, intelligence the attackers had gathered beforehand.
Old weaknesses, so basic hygiene still works
Unit 42's central point is that the AI raised volume, not sophistication. The weaknesses exploited were familiar: authentication bypasses, insecure direct object references, mass-assignment privilege escalation, weak and default credentials, exposed cloud APIs and dated public CVEs. Likely a single operator or small team ran simultaneous attempts against 19 organizations in two weeks, removing the old ceiling set by operator hours. It fits the picture Google painted earlier this month of AI agents running real intrusions.
- Unit 42 says identity hygiene, attack-surface reduction and patching remain effective: retire weak and shared passwords on internet-facing apps, partner integrations and VPNs.
- Close open self-registration and account-creation paths, and audit object-level authorization in CMS and identity platforms.
- Patch old public CVEs on exposed services.
- Hunt for the Cairn server 154[.]44[.]31[.]4 (Hong Kong) and the staging and egress host 82[.]29[.]129[.]54 (U.S.).
The uncomfortable lesson is not that the AI found anything clever. It is that one small team could knock on 19 doors at once, and keep knocking for two days straight without getting tired.
This briefing is provided by IntelFusions for informational and defensive purposes only. It is based on sources assessed to be reliable at the time of writing, and analytic judgments carry the confidence levels indicated. Indicators of compromise are defanged; re-arm them only in controlled environments. IntelFusions is not affiliated with the organizations named and makes no warranty as to completeness or accuracy.