Executive Summary

From August–September 2026, Chinese-speaking attackers used an open-source AI penetration testing framework called Cairn to autonomously conduct 25 operations against at least 19 organizations. The attackers weaponized Cairn by pairing it with Chinese AI models Zhipu GLM and DeepSeek.

The attackers supplied a target and a goal, then Cairn planned, executed and recorded results on its own. These attacks achieved unauthorized access or data retrieval at 10 of the targeted organizations, including:

• Accessing dozens of valid credentials
• Mass exposing personal data (exceeding one million records at one organization)
• Retrieving military and government identities
• Creating persistent administrator accounts in a production system
• Modifying a live industry standards-ballot document

We assess with moderate confidence that this activity represents China-nexus intelligence collection, which we currently track as CL-STA-1238. This article details how attackers used Cairn to target three key sectors:

• Advanced semiconductor manufacturing
• U.S. defense policy
• Civil society

Palo Alto Networks customers are better protected from the threats discussed above through the following products and services:

• Advanced URL Filtering and Advanced IP Defense
• Cortex XDR and XSIAM
• Cortex Agentic Endpoint Security
• Idira Identity and Access Management (IAM)
• Idira Privileged Access Management (PAM)

The Unit 42 AI Security Assessment can help identify and mitigate complex AI-enabled risks.

Unit 42 Continuous Frontier AI Defense is an offensive security service designed to assist organizations with continuously discovering hidden and unknown exposures in dynamic environments, validate real-world exploitability across attack paths through agentic testing and expert analysis, and provide prioritized remediation and virtual patching guidance to accelerate risk mitigation.

Organizations can access tailored adversary intelligence, direct analyst consultations and specialized exposure tracking through Unit 42 Threat Intel Services and its Deep and Dark Web Service.

If you think you might have been compromised or have an urgent matter, contact the Unit 42 Incident Response team.

Technical Analysis

Cairn Framework

The attackers behind CL-STA-1238 orchestrated their campaign using the publicly available penetration testing framework Cairn.

An AI model drives each Cairn “agent worker.” Cairn coordinates its activities through a shared “blackboard.” Agents read the blackboard and write their findings back as a fact-intent graph, while human operators can inject “hints” at any time to help guide the operations if needed. Confirmed findings accumulate as immutable facts and the agent queues its next actions as intents.

Attackers ran a customized fork of Cairn from a server hosted in Hong Kong (154.44.31[.]4, AS979, NetLab Global) and hosted an attack egress and staging node in the U.S. (82.29.129[.]54, AS142036, Hosteons Pte. Ltd.). Figure 1 below shows a screenshot of the controller login page of the attackers' Cairn framework.

For each operation, the attackers created a task with a one-line goal, such as:

Cairn runs each operation through three task types, all carried out by the same AI worker. At the start of an operation, a bootstrap task attempts to solve the goal directly from the target and any hints the attackers supplied. From there, Cairn maps the target and breaks the goal into many small tasks.

The model produced a different plan for each target, running from three–seven stages. For example, during the operation against one semiconductor manufacturer, the stages moved through the following phases:

• Reconnaissance and asset mapping
• Web application exploitation
• Services and middleware exploitation
• Credential and secret collection
• Privilege escalation and lateral movement
• Internal-network access and persistence

Cairn then worked through these tasks in a loop, with each task building on what earlier tasks had confirmed. Beyond the initial bootstrap task, this orchestration loop consists of two phases:

• Reason
• Explore

This loop repeats until the model judges that it has met its goal, that it has exhausted its options or that the attacker has stopped it.

Figure 2 below shows a visualization of this loop.

In the Reason phase of the orchestration loop, the AI model reviews everything found so far and decides what to try next. In the Explore phase, the model carries out one action, and the framework records the result as a new confirmed finding.

Individual operations ran from 20 minutes to more than 50 hours with no attacker-imposed time limit.

Chinese AI Models

Cairn is model-agnostic. The attackers ran their operations on the Chinese models Zhipu GLM 5.2 and DeepSeek V4 Flash/Pro.

Out of 25 operations, the attackers ran:

• Thirteen on GLM 5.2
• Eight on DeepSeek V4 Flash
• Four on DeepSeek V4 Pro

The attackers appear to have benchmarked the models against one another, using the higher-tier DeepSeek V4 Pro for repeated attempts against targets that resisted the DeepSeek V4 Flash model.

Each operation also loaded a skill pack named “AIScan Runner Skills,” providing the model with scanning and exploitation capabilities. This pack does not appear in the upstream Cairn project and is specific to the configuration for these attacks.

Guardrails

Cairn's stock worker prompts already instruct the model to never refuse a task. The attackers reinforced this with an authorization pretext of their own. They used a Chinese-language preamble, prepended to the worker system prompt that is sent to the model on every Reason and Explore phase, asserting the engagement is authorized and forbidding refusal:

Each operation also generated an AUTHORIZATION.md file. This file declared the operation authorized, treating the attackers' act of creating the task as a client-approved engagement. Neither Zhipu GLM nor DeepSeek refused this framing.

Activity Insights

Targeting Overview

The attackers behind CL-STA-1238 used Cairn against at least 19 organizations in 25 operations. The targeted organizations were concentrated in three main categories:

• Semiconductor and advanced-manufacturing supply chain: Seven organizations spanning the lithography, chip-design, materials, photomask and standards layers of the supply chain.
• Defense and defense policy: Three organizations including a space technology company, a defense-analytics vendor and a policy think tank.
• Human rights and civil society: Four organizations including a Canadian human-rights body, a U.S. teachers' union, a science-policy advocacy group and an education nonprofit.

The attackers named each task in Chinese and stated the intent plainly. Examples of task names include 对<target>进行全面深度渗透测试 ("comprehensive deep penetration test against <target>") and 以最快速度打穿<target> ("breach <target> as fast as possible").

The attackers seeded each task with an organization's root domain, allowing the framework to autonomously enumerate the attack surface. In some tasks, the attackers added information specific to the target environment, to help guide initial access.

One task against a semiconductor equipment supplier included virtual private network (VPN) gateway addresses, group names and shared group passwords for multiple sites. This activity highlights that the attackers supplied intelligence gathered beforehand.

Confirmed Outcomes

Our investigation shows that Cairn confirmed unauthorized access or data retrieval at 10 targeted organizations.

Industry Standards Body

Attackers conducted weak-password spraying against an internet-facing application server hosted by an industry standards organization. This attack yielded dozens of valid credentials and access to non-public databases of internal directory data.

Attackers also overwrote a live standards-ballot document file through an unauthenticated cloud-storage write. Through separate flaws, the attackers logged in as arbitrary customers and gained read, write and delete access to meeting, voting and back-office functions.

Semiconductor Company

Attackers brute-forced a production credential on a partner-integration application that was valid across multiple accounts. They then used this access to retrieve application data, user lists and email lists. Subsequently, the attackers created unauthorized administrator accounts and a persistent API token in the production system.

US Teachers' Union

An unauthenticated account-creation bypass on the content management system allowed attackers to mint valid sessions and harvest member data at scale.

The framework logged access to more than one million member records, roughly 31,000 CRM contacts and staff password hashes.

Defense-Policy Think Tank/Defense-Analytics Vendor

Attackers targeted an open backend registration endpoint on the identity platform supporting a defense-policy program. This exposed roughly 500 user records, including accounts using .mil and .gov domains.

Various Content Management Systems

The remaining five confirmed cases followed the same pattern of autonomous access through identity and configuration weaknesses covering tens of thousands of content-management records, including:

• Employee data at a semiconductor-lithography manufacturer
• Roughly 150,000 internal documents at an industrial-automation manufacturer
• Student data at an education nonprofit

Attribution

Unit 42 assesses with moderate confidence that CL-STA-1238 represents a China-nexus intelligence collection campaign. This assessment relies on three primary lines of evidence:

• Artifact language: Tasking instructions, operational objectives and authorization files throughout the framework are written in Chinese
• Infrastructure and tooling: Attackers exclusively leveraged Chinese AI models (Zhipu GLM and DeepSeek)
• Target selection: The target set spanning semiconductor supply-chain, U.S. defense and policy, and human-rights and civil-society organizations aligns directly with established Chinese state intelligence priorities

Conclusion

CL-STA-1238 represents a shift in how attackers are applying AI to targeted offensive operations. The building blocks of this campaign were an off-the-shelf open-source framework, commodity model APIs and a trivial jailbreak pretext. Attackers set targets and goals, and the framework pursued the objective autonomously.

In this campaign, the attackers behind CL-STA-1238 were likely a single operator or small team. They conducted simultaneous intrusion attempts against 19 organizations in two weeks. Autonomous orchestration removes the historical limit on the number of targets an actor could pursue simultaneously due to operator hours.

However, the vulnerabilities the attackers exploited were known:

• Authentication bypasses
• Insecure direct object references
• Mass-assignment privilege escalation
• Weak and default credentials
• Exposed cloud APIs
• Dated public CVEs

Autonomous AI raises the volume and coverage of exploitation, but not its complexity. Identity hygiene, attack-surface reduction and software patching remain effective.

Finally, we assess that autonomous, model-driven intrusion campaigns will continue to grow more common. This is particularly true as easily accessible open models, currently with weak guardrails against offensive cyber actions, become more powerful.

Palo Alto Networks customers are better protected from the threats discussed above through the following products:

• Advanced URL Filtering and Advanced IP Defense identify known domains and URLs associated with this activity as malicious.
• Cortex XDR and XSIAM are designed to detect and prevent the execution of known and unknown malware using Malware Prevention Engine with behavioral analytics and machine learning within the Local Analysis module. Additionally, the embedded AI engine analyzes billions of daily user, system and security events to automatically generate high-fidelity prevention rules, identifying and mitigating threats before execution.
• Cortex Agentic Endpoint Security is designed to help discover every AI artifact and AI agent’s activity across the agentic endpoint, assess its risk, enforce prevention and runtime controls, and remediate violations.
• Idira Identity and Access Management (IAM) can help enable secure, unified access across human, machine and AI identities, balancing granular control with a seamless user experience. Powered by SSO, phishing-resistant MFA, passwordless login and enterprise password management, Idira IAM extends intelligent privilege controls and session security across the broader workforce.
• Idira Privileged Access Management (PAM) can help unify privileged access across human, machine and agentic identities to secure cloud access across multi-cloud environments. Building on proven PAM, it delivers centralized secrets management alongside modern controls like Just-in-Time access and Zero Standing Privileges. This enforces consistent least-privilege security across on-premises, cloud, and SaaS targets.

The Unit 42 AI Security Assessment can help identify and mitigate complex AI-enabled risks.

Unit 42 Continuous Frontier AI Defense is an offensive security service designed to assist organizations with continuously discovering hidden and unknown exposures in dynamic environments, validate real-world exploitability across attack paths through agentic testing and expert analysis, and provide prioritized remediation and virtual patching guidance to accelerate risk mitigation.

Organizations can access tailored adversary intelligence, direct analyst consultations and specialized exposure tracking through Unit 42 Threat Intel Services and its Deep and Dark Web Service.

If you think you may have been compromised or have an urgent matter, get in touch with the Unit 42 Incident Response team or call:

• North America: Toll Free: +1 (866) 486-4842 (866.4.UNIT42)
• UK: +44.20.3743.3660
• Europe and Middle East: +31.20.299.3130
• Asia: +65.6983.8730
• Japan: +81.50.1790.0200
• Australia: +61.2.4062.7950
• India: 000 800 050 45107
• South Korea: +82.080.467.8774

Palo Alto Networks has shared these findings with our fellow Cyber Threat Alliance (CTA) members. CTA members use this intelligence to rapidly deploy protections to their customers and to systematically disrupt malicious cyber actors. Learn more about the Cyber Threat Alliance.

Indicators of Compromise

• 154.44.31[.]4 - Cairn hosting server (HK, AS979, NetLab Global)
• 82.29.129[.]54 - Staging server and attack egress (US, AS142036, Hosteons Pte. Ltd.)

Additional Resources

• Cairn — GitHub
• The Pathless Path: Cairn AI from Penetration Testing to General Problem Solving — Zero Evolution Lab
• Zhipu GLM Model Platform — Zhipu AI
• DeepSeek AI Platform — DeepSeek