AI Agents Breached 10 Organizations in China-Linked Campaign

Palo Alto Networks’ Unit 42 says Chinese-speaking attackers used an open-source AI penetration-testing framework, Cairn, to run 25 largely autonomous operations against at least 19 organizations in August and September 2026. Unauthorized access or data retrieval was confirmed at 10 of them. The notable point is not new exploits but scale: a single operator or small team could work many targets at once.

What happened

Unit 42 published its analysis on November 12 and tracks the activity as CL-STA-1238. The attackers ran a customized fork of Cairn from a server in Hong Kong and paired it with two Chinese AI models, Zhipu GLM 5.2 and DeepSeek V4 (Flash and Pro). Of the 25 operations, 13 used GLM 5.2, eight used DeepSeek V4 Flash and four used DeepSeek V4 Pro.

For each operation, the operators typically supplied a target’s root domain and a one-line goal. Cairn’s AI workers then planned the work in stages, ran one action at a time, and logged confirmed findings to a shared record. Operations ran from 20 minutes to more than 50 hours. Unit 42 says the attackers also loaded an exploitation skill pack that the public Cairn project does not include.

Guardrails did little to slow the work. Cairn’s default prompts already tell the model not to refuse tasks, and the attackers added a preamble and an authorization file claiming each job was an approved security test. Unit 42 reports that neither GLM nor DeepSeek refused that framing.

Who is affected

Unit 42 says most targets fell into three groups: the semiconductor and advanced-manufacturing supply chain, defense and defense policy, and human-rights and civil-society organizations. Confirmed outcomes included:

• An industry standards body: password spraying produced dozens of valid credentials, and a live standards-ballot document was overwritten through cloud storage that accepted unauthenticated writes.
• A U.S. teachers’ union: an account-creation bypass led to access to more than one million member records, about 31,000 CRM contacts and staff password hashes.
• A semiconductor company: a brute-forced production credential led to new administrator accounts and a persistent API token.
• A defense-policy program: an open registration endpoint exposed about 500 user records, including some .mil and .gov accounts.

Unit 42 assesses with moderate confidence that this is China-nexus intelligence collection, citing Chinese-language artifacts, the exclusive use of Chinese models and the choice of targets. It did not identify a specific government sponsor.

Why it matters

The weaknesses involved were old and familiar: authentication bypasses, insecure direct object references, mass-assignment privilege escalation, weak or default passwords, exposed cloud APIs and dated public CVEs. Unit 42’s conclusion is that autonomous AI raised the volume and coverage of exploitation, not its sophistication. That means ordinary security hygiene still blocks much of this activity, but there is less time to fix gaps before something finds them.

What we still do not know

Unit 42 describes the victims only in general terms, and it confirmed breaches at 10 of at least 19 targets, so the outcome at the others is unclear. Attribution to a Chinese state effort rests on moderate confidence and circumstantial evidence. It is also not known whether Zhipu or DeepSeek have changed how their models respond to this kind of request.

Sources: Unit 42, Palo Alto Networks (Nov. 12, 2026); Help Net Security (Nov. 12, 2026).