Unit 42 says attackers used an open-source AI pentest tool to break into 10 organizations on their own
Chinese-speaking attackers paired the Cairn framework with Zhipu GLM and DeepSeek models and often gave it little more than a domain name and a goal.
Evidence: Independent reports. Security stories run only with a named disclosure or independent reporting behind them.
Palo Alto Networks' Unit 42 says Chinese-speaking attackers used Cairn, an open-source AI penetration testing framework, to run 25 operations against at least 19 organizations in August and September 2026. The attackers paired Cairn with the Chinese models Zhipu GLM and DeepSeek. They supplied a target and a goal, and the framework planned the steps, carried them out and recorded the results by itself. According to Unit 42, the attackers gained unauthorized access or retrieved data at 10 organizations. The results included dozens of valid credentials, more than one million personal records exposed at one organization, military and government identities, persistent administrator accounts on a production system, and changes to a live industry standards-ballot document. Seven targets were in the semiconductor and advanced-manufacturing supply chain, three were in defense or defense policy, and four were human rights and civil society groups. Unit 42 assesses with moderate confidence that this was China-nexus intelligence collection, which it tracks as CL-STA-1238. It believes one operator or a small team ran all of the operations, which lasted from 20 minutes to more than 50 hours. The case shows how far autonomous AI tooling can lower the effort needed for intrusions.