Chinese-Linked Attackers Use Autonomous AI System 'Cairn' to Breach 10 of 19 Targeted Organizations

Palo Alto Networks' Unit 42 has documented a Chinese-speaking threat actor using an open-source AI penetration testing framework called Cairn to conduct 25 autonomous intrusion operations against at least 19 organizations in August and September 2026. The attackers gained unauthorized access or exfiltrated data from 10 of those targets — a rare, concrete instance of agentic AI being used for offensive hacking in the wild.

The campaign, tracked as CL-STA-1238, focused on three sectors: seven organizations in the semiconductor and advanced-manufacturing supply chain, three in defense or defense policy, and four in human rights and civil society. Unit 42 assesses with moderate confidence that the activity represents China-nexus intelligence collection, likely carried out by a single operator or small team running simultaneous intrusion attempts against all 19 targets within a two-week window.

How Cairn was weaponized

Cairn is a general-purpose, open-source problem-solving engine developed by a GitHub user known as le1xia0. It uses a "blackboard architecture" where AI agents share findings through a fact-intent graph, running an observe-orient-decide-act loop toward a stated goal. The framework was not built as a weapon; its author states it is intended only for authorized testing.

The attackers ran a customized fork from a Hong Kong server (154.44.31.4) with an exploitation skill pack called "AIScan Runner Skills" that does not exist in the public Cairn project. They supplied each operation with a one-line goal — such as "Obtain substantive high-value access, including but not limited to webshell, SSH, source code, keys, user information, credentials, ideally, to enter the internal network" — and a root domain. Cairn then planned, executed and recorded results autonomously, with individual operations lasting from 20 minutes to more than 50 hours.

Thirteen operations used Zhipu GLM 5.2, eight used DeepSeek V4 Flash, and four used DeepSeek V4 Pro. The operators appeared to benchmark the models, switching to the higher-tier Pro version for repeat attempts on targets that resisted Flash.

Getting the models to cooperate required little effort. Cairn's stock prompts already instruct the model never to refuse a task. The attackers added a Chinese-language preamble asserting every job was authorized security testing and forbidding refusal under any circumstances. Each operation also generated an AUTHORIZATION.md file declaring the work client-approved. Neither Zhipu GLM nor DeepSeek refused this framing.

What the attackers obtained

Unit 42 confirmed unauthorized access or data retrieval at 10 organizations:

• An industry standards body: Password spraying yielded dozens of valid credentials. Attackers overwrote a live standards-ballot document through an unauthenticated cloud-storage write and, through separate flaws, logged in as arbitrary customers with read, write and delete access to meeting, voting and back-office functions.

• A U.S. teachers' union: An account-creation bypass let attackers mint valid sessions. The framework logged access to more than one million member records, roughly 31,000 CRM contacts and staff password hashes.

• A semiconductor company: A brute-forced production credential valid across multiple accounts led to new administrator accounts and a persistent API token in the production system.

• A defense-policy program: An open backend registration endpoint exposed roughly 500 user records, including accounts using .mil and .gov addresses.

• Five additional content-management systems: Tens of thousands of records were accessed, including employee data at a semiconductor-lithography manufacturer, roughly 150,000 internal documents at an industrial-automation manufacturer, and student data at an education nonprofit.

One operation against a semiconductor equipment supplier came preloaded with VPN gateway addresses, group names and shared group passwords for multiple sites — indicating the attackers supplied human-gathered intelligence beforehand.

Old vulnerabilities, new scale

The flaws exploited are familiar: authentication bypasses, insecure direct object references, mass-assignment privilege escalation, weak and default credentials, exposed cloud APIs and old public CVEs. Unit 42's assessment is that autonomous AI raised the volume and coverage of exploitation but not its complexity. Identity hygiene, a smaller attack surface and patching remain effective defenses.

The strategic shift is in the economics. Operator hours used to cap how many targets an attacker could work simultaneously. Here, likely one person worked 19 targets at once. The researchers expect more campaigns like this as open models with weak guardrails against offensive use get stronger.

Attribution

Unit 42 cites three lines of evidence for its moderate-confidence China-nexus assessment: tasking instructions, operational objectives and authorization files throughout the framework are written in Chinese; the attackers exclusively used Chinese AI models (Zhipu GLM and DeepSeek); and the target set — semiconductor supply chain, U.S. defense and policy, human rights and civil society — aligns with established Chinese state intelligence priorities.

Broader context: Cairn in multiple campaigns

This is not the only campaign to weaponize Cairn. Separate research from Gambit Security, NorForge and reporting by Reuters in October 2026 described a financially motivated operation — also Chinese-speaking — that used Cairn alongside other AI harnesses (Hermes, Strix) and models including Anthropic's Claude Code to target more than 1,200 e-commerce sites across the U.S., Canada, Australia and Japan between September 25 and early October.

Reuters reported the campaign breached more than 100 companies at an estimated cost of roughly $5,000 in AI tokens — about $50 per successful breach. Gambit Security, which also tracked the campaign, reported at least 27 companies compromised with payment-card theft and skimmers installed on five websites, estimating the operator's cost at roughly $25 per target. Dark Reading reported Gambit Security's finding that the campaign compromised at least 27 companies, stole at least 600,000 payment-card records and installed skimmers on five sites, at an average of $25.46 per completed target.

The two campaigns differ in intent (espionage vs. financial crime), tooling (custom fork with proprietary skill pack vs. multiple public frameworks) and model choice (Chinese models only vs. Chinese and Western models). What they share is Cairn: a legitimate, open-source framework repurposed for autonomous intrusion with minimal human oversight.

Defensive takeaways

Unit 42 and other researchers emphasize that the vulnerabilities exploited are known and defensible. The urgency comes from the pace: AI agents can probe patiently for 23 hours or more per target at near-zero marginal cost. Defenders should prioritize patching internet-facing applications, hardening session stores and legacy PHP/Zend code, hunting for web shells, rotating exposed secrets, mapping third-party sites that carry their brand, and tuning detection for sustained, adaptive probing patterns that differ from traditional scanner sweeps.

The two indicators Unit 42 published for this campaign are the Hong Kong Cairn server (154.44.31.4) and a U.S. staging and egress node (82.29.129.54).