In a series of sophisticated cyber operations from August to September 2026, Chinese-speaking attackers exploited the open-source AI penetration testing framework Cairn to autonomously conduct 25 attacks against at least 19 organizations, primarily in the semiconductor and defense sectors. The attackers paired Cairn with Chinese AI models Zhipu GLM and DeepSeek, enabling them to achieve unauthorized access or data retrieval at 10 of the targeted entities, according to a report by Palo Alto Networks’ Unit 42.
Autonomous Operations and Targeting
The attackers utilized Cairn to automate the planning and execution of their operations, requiring only a target and a goal to initiate the process. This framework allowed for a high degree of autonomy, with the AI managing tasks such as reconnaissance, exploitation, and data retrieval without continuous human oversight. The operations reportedly resulted in significant breaches, including the exposure of over one million personal records and the creation of unauthorized administrator accounts within production systems.
Unit 42 assessed with moderate confidence that these activities are linked to intelligence collection efforts associated with China, designated as CL-STA-1238. The targeted organizations included seven in the semiconductor supply chain, three in defense policy, and four related to civil society and human rights.
Technical Insights into Cairn’s Functionality
Cairn operates through a shared “blackboard” system where AI agents communicate findings and plan subsequent actions. Each operation began with a bootstrap task aimed at achieving the specified goal, followed by a series of smaller tasks tailored to the target. The attackers ran a customized version of Cairn from a server in Hong Kong and utilized a staging node in the U.S., indicating a well-coordinated infrastructure.
During their operations, the attackers employed various task types, including reconnaissance, web application exploitation, and privilege escalation. For instance, in one operation against a semiconductor manufacturer, the attackers executed a multi-stage plan that involved mapping the target, exploiting vulnerabilities, and ultimately gaining internal network access.
Confirmed Breaches and Data Exfiltration
Among the confirmed breaches, the attackers successfully accessed sensitive data from multiple organizations. Notably, they conducted weak-password spraying against an industry standards organization, resulting in access to internal databases and the exposure of non-public information. In another case, a U.S. teachers’ union suffered a significant data breach, with attackers harvesting over one million member records through an unauthenticated account-creation bypass.
The attackers’ choice of targets aligns with established Chinese state intelligence priorities, focusing on sectors critical to national security and technological advancement. The use of Chinese AI models further supports the attribution of these operations to state-sponsored actors.
Implications and Future Trends
The use of autonomous AI frameworks like Cairn marks a significant evolution in cyber offensive operations, allowing attackers to scale their efforts beyond traditional limits. While the vulnerabilities exploited in these attacks were known and could have been mitigated through better security practices, the integration of AI into cyber operations raises concerns about the future landscape of cyber threats.
As autonomous, model-driven intrusion campaigns become more prevalent, organizations must prioritize identity hygiene, attack-surface reduction, and timely software patching to defend against these evolving threats. The findings from this campaign underscore the need for enhanced security measures and proactive threat intelligence to counteract the growing capabilities of cyber adversaries.
For further insights into the implications of AI in cybersecurity, refer to the detailed analysis provided by Palo Alto Networks’ Unit 42 on their [Cairn framework and its applications](https://unit42.paloaltonetworks.com/cairn-framework-ai-autonomous-attacks/).
