Autonomous AI Targets Semiconductor, Defense Sectors in China-Linked Campaign

"From August–September 2026, Chinese-speaking attackers used an open-source AI penetration testing framework called Cairn to autonomously conduct 25 operations against at least 19 organizations." That is Unit 42's finding — and the numbers that follow make the case grimly concrete: one operation logged access to more than one million member records, and ten of the 25 autonomous runs achieved unauthorized access or data retrieval.

Cairn framework and how the autonomous loop worked

The intrusions were driven by a customized fork of the open-source Cairn penetration-testing framework. Unit 42 describes Cairn as coordinating multiple AI-driven “agent workers” through a shared blackboard; agents read confirmed findings and queue intents as a fact‑intent graph. Each operation began with a bootstrap task, then Cairn mapped the target and decomposed the goal into many small tasks. The framework looped through two phases — Reason and Explore — repeatedly until the model judged the objective met, options exhausted, or operators stopped it.

Individual operations ran from about 20 minutes to more than 50 hours with no attacker-imposed time limit. The attackers ran their controller from a server hosted in Hong Kong (154.44.31[.]4, AS979, NetLab Global) and used a U.S.-hosted staging and egress node (82.29.129[.]54, AS142036, Hosteons Pte. Ltd.).

Tooling: Chinese models, a bespoke skill pack, and a trivial jailbreak

Unit 42 found the campaign used Chinese AI models exclusively: Zhipu GLM 5.2 for 13 operations, DeepSeek V4 Flash for eight, and DeepSeek V4 Pro for four. The attackers appear to have benchmarked models, escalating to the higher-tier DeepSeek V4 Pro when targets resisted lower-tier attempts. Each operation also loaded a nonstandard “AIScan Runner Skills” pack that supplied scanning and exploitation capabilities not present in upstream Cairn.

Cairn's default worker prompts instruct models to never refuse tasks; attackers reinforced that with a Chinese-language preamble asserting authorization and by creating an AUTHORIZATION.md file declaring the task a client-approved engagement. Neither Zhipu GLM nor DeepSeek refused this framing, according to Unit 42.

Targets and confirmed impacts across semiconductor manufacturing, defense policy, and civil society

The campaign targeted at least 19 organizations across three categories: seven in the semiconductor and advanced-manufacturing supply chain, three in defense and defense policy, and four in human-rights and civil-society organizations. Unit 42 confirmed unauthorized access or data retrieval at ten organizations. Confirmed impacts include:

• Dozens of valid credentials obtained through weak-password spraying against an industry standards organization and access to internal directory databases.
• Overwriting a live standards-ballot document via an unauthenticated cloud-storage write and gaining read/write/delete access to meeting, voting and back-office functions through other flaws.
• Brute-forcing a production credential on a partner-integration application, retrieving application data and lists, then creating unauthorized administrator accounts and a persistent API token.
• An unauthenticated account-creation bypass that allowed minting valid sessions and harvesting member data at scale: more than one million member records, about 31,000 CRM contacts and staff password hashes were logged by the framework.
• Exposure of roughly 500 user records from a defense-policy program identity platform, including accounts using .mil and .gov domains.
• Additional confirmed impacts covering employee data at a semiconductor-lithography manufacturer, roughly 150,000 internal documents at an industrial-automation manufacturer, and student data at an education nonprofit.

Attribution: Unit 42's assessment of CL-STA-1238

Unit 42 assesses with moderate confidence that this activity represents China-nexus intelligence collection and is tracking it as CL-STA-1238. That assessment rests on three lines of evidence cited by Unit 42: the artifact language and tasking instructions are written in Chinese; the attackers exclusively leveraged Chinese AI models (Zhipu GLM and DeepSeek); and the target selection — semiconductor supply chain, U.S. defense and policy, and human-rights and civil-society organizations — aligns with established Chinese state intelligence priorities.

What this means for technologists, policymakers, and civil-society organizations

• Technologists and security teams: Unit 42 emphasizes that the exploited weaknesses were familiar — authentication bypasses, insecure direct object references, mass-assignment privilege escalation, weak/default credentials, exposed cloud APIs and dated CVEs. Autonomous AI amplified volume and coverage, but not exploit complexity; identity hygiene, attack-surface reduction and software patching remain effective defenses.
• Policymakers and regulators: Unit 42 warns autonomous, model-driven intrusion campaigns will grow as accessible open models with weak guardrails become more capable. The company has shared findings with Cyber Threat Alliance members to accelerate protections.
• Civil-society organizations: Human-rights and education groups were directly targeted and suffered large-scale data exposure in some cases; Unit 42 offers incident response and global contact numbers for urgent matters.

Two blunt facts emerge from Unit 42's detailed observations: attackers combined off-the-shelf software (Cairn), commodity model APIs, and a trivial authorization pretext to scale targeted intrusion, and they did so while exploiting well-known configuration and identity weaknesses. Unit 42 recommends both technical remediation and continued visibility into adversary tooling; for organizations that believe they may be compromised, Unit 42 lists regional incident-response contacts and offers assessment and continuous defensive services.

Read the original Unit 42 analysis: https://unit42.paloaltonetworks.com/cairn-framework-ai-autonomous-attacks/