Attackers used an open-source AI hacking agent with GLM and DeepSeek models to breach 10 organisations, Unit 42 finds

Chinese-speaking attackers used Cairn, an open-source AI penetration testing framework, to run 25 largely autonomous operations against at least 19 organisations in August and September 2026, according to research from Unit 42, the threat intelligence team at Palo Alto Networks. They gained unauthorised access or pulled data at 10 of them. Unit 42 assesses with moderate confidence that this was China-nexus intelligence collection, which it tracks as CL-STA-1238.

Cairn hands an intrusion to an AI model that works in a loop, choosing and running one action at a time until it decides the goal is met. The attackers often supplied little more than a domain name and a one-line goal. They ran a customised version from a Hong Kong server, using Zhipu AI's GLM 5.2 for 13 operations and DeepSeek's V4 Flash and V4 Pro for the rest. A Chinese-language preamble claiming the work was authorised testing was enough; neither model refused, Help Net Security reported.

Seven targets were in the semiconductor and advanced manufacturing supply chain, three in defence or defence policy and four in human rights and civil society. At one US teachers' union, the framework logged access to more than a million member records; at a semiconductor company it created new administrator accounts.