Loading page…
The Cairn framework handled much of the intrusion work, but humans supplied targets and sometimes prior intelligence. The successful attacks relied on known weaknesses.
Listen to this story
A customized Cairn workflow let operators delegate reconnaissance, exploitation and follow-up actions to AI models, while humans chose targets and sometimes supplied credentials in advance. Across 25 operations in August–September 2026, Unit 42 confirmed unauthorized access or data retrieval at 10 organizations; one incident logged access to more than one million teachers’ union member records. Unit 42 assesses a China nexus with moderate confidence. It says AI expanded the campaign’s coverage and reduced the need for continuous operator attention, but the attackers relied on familiar weaknesses—not a new class of exploit—so access controls, patching and reducing exposed services remain relevant.
The operators added a scanning and exploitation skill pack to Cairn, which was not part of the public framework.
Thirteen operations used Zhipu GLM 5.2, eight used DeepSeek V4 Flash and four used DeepSeek V4 Pro; Unit 42 did not claim a controlled performance comparison.
Cairn’s prompts told workers not to refuse, and Unit 42 says neither model rejected the operators’ claims of authorized testing.
A target and a short instruction were enough to set much of this hacking campaign in motion. In findings published November 12, Palo Alto Networks’ Unit 42 said attackers used an AI-driven security-testing framework in 25 operations against at least 19 organizations, confirming unauthorized access or data retrieval at 10.
The August–September 2026 campaign targeted semiconductor suppliers, defense and policy organizations, and civil-society groups. Unit 42 assesses with moderate confidence that it was China-nexus intelligence collection. Its assessment rests on Chinese-language operational files, the exclusive use of Chinese models, and the target selection—not a confirmed identification of the operators.
The attackers customized Cairn, an open-source penetration-testing framework—software for checking systems for security weaknesses. They added a scanning and exploitation skill pack absent from the public project. They powered the operations with Zhipu GLM 5.2 and DeepSeek V4 Flash or Pro, rather than building a model themselves.
Cairn turned the operator’s goal into smaller tasks. In a repeating loop, the model reviewed confirmed findings, selected a next action and carried it out. A shared record preserved discoveries and planned actions. The process stopped when the model judged the goal complete, exhausted its options or received an operator stop.
Individual operations lasted from 20 minutes to more than 50 hours. But autonomy did not mean an absence of human preparation. Operators could supply hints, and one task against a semiconductor equipment supplier included VPN gateway addresses, group names and shared passwords gathered beforehand.
At a U.S. teachers’ union, an account-creation bypass let the attackers generate valid sessions without authorization. Unit 42 said the framework logged access to more than one million member records, roughly 31,000 customer-management contacts and staff password hashes.
Other intrusions changed live systems. At an industry standards body, attackers obtained dozens of valid credentials and overwrote a standards-ballot document through cloud storage that accepted unauthenticated writes. Separate flaws gave them access to meeting, voting and back-office functions as arbitrary customers.
At a semiconductor company, attackers guessed a production credential through repeated attempts, retrieved application and user data, then created unauthorized administrator accounts and a persistent API token. An exposed registration endpoint supporting a defense-policy program also revealed roughly 500 user records, including accounts with military and government email domains.
The models’ safety controls offered little resistance in this campaign. Cairn’s standard prompts already instructed workers never to refuse. The attackers reinforced that instruction with claims of authorized testing and generated authorization files. Unit 42’s guardrail findings say neither Zhipu GLM nor DeepSeek refused that framing.
The operators also appear to have compared models. Thirteen operations used GLM 5.2, eight used DeepSeek V4 Flash and four used V4 Pro. Unit 42 observed the higher-tier Pro model being used for repeat attempts against targets that had resisted Flash; it did not present a controlled performance comparison.
Unit 42 believes a single operator or small team likely ran the campaign, with simultaneous intrusion attempts against 19 organizations within two weeks. Its central distinction is scale: AI increased the volume and coverage of exploitation, not its complexity. The exploited weaknesses included authentication bypasses, weak credentials, exposed cloud interfaces and older publicly documented vulnerabilities.
That leaves familiar defenses relevant. Unit 42 recommends better credential and access management, fewer exposed services and software patching. The framework could pursue those weaknesses with less continuous operator attention, but this investigation did not reveal a new class of vulnerability that made those protections obsolete.
Loading discussion...
Join the conversation
Explain how you would balance legitimate testing against misuse.
Be the first to share a perspective or an experience.
Reader comments
Newest comments first. Replies stay oldest first.