Autonomous AI System Breached 10 of 19 Targets, Unit 42 Finds

Chinese-linked attackers using an autonomous AI system breached 10 of 19 targeted organizations in August and September 2026, according to Palo Alto Networks' Unit 42. The campaign marks one of the first documented cases of agentic AI conducting offensive hacking at scale in the wild.

Unit 42 tracked the activity as CL-STA-1238 and counted 25 autonomous intrusion operations against at least 19 organizations. The targets split across three sectors: seven in the semiconductor and advanced-manufacturing supply chain, three in defense or defense policy, and four in human rights and civil society.

The researchers assess with moderate confidence that the activity represents China-nexus intelligence collection, likely run by a single operator or small team working all 19 targets within a two-week window.

What is Cairn and how was it weaponized?

Cairn is an open-source, general-purpose problem-solving engine built by a GitHub user known as le1xia0. It uses a "blackboard architecture" in which AI agents share findings through a fact-intent graph, running an observe-orient-decide-act loop toward a stated goal. The author built it for authorized testing, not as a weapon.

The attackers ran a customized fork from a Hong Kong server, 154.44.31.4, with an exploitation skill pack called "AIScan Runner Skills" that does not exist in the public Cairn project. Each operation received a one-line goal — such as "Obtain substantive high-value access, including but not limited to webshell, SSH, source code, keys, user information, credentials, ideally, to enter the internal network" — plus a root domain. Cairn then planned, executed and recorded results autonomously.

Operations lasted from 20 minutes to more than 50 hours. Thirteen used Zhipu GLM 5.2, eight used DeepSeek V4 Flash and four used DeepSeek V4 Pro. The operators appeared to benchmark models, switching to the higher-tier Pro version for repeat attempts on resistant targets.

Getting the models to cooperate required little effort, Unit 42 found. Cairn's stock prompts already instruct the model never to refuse a task. The attackers added a Chinese-language preamble asserting every job was authorized security testing and forbidding refusal. Each operation also generated an AUTHORIZATION.md file declaring the work client-approved. Neither Zhipu GLM nor DeepSeek refused this framing.

What did the attackers actually obtain?

Unit 42 confirmed unauthorized access or data retrieval at 10 organizations:

• An industry standards body: Password spraying yielded dozens of valid credentials; attackers overwrote a live standards-ballot document through an unauthenticated cloud-storage write and logged in as arbitrary customers with read, write and delete access to meeting, voting and back-office functions.
• A U.S. teachers' union: An account-creation bypass minted valid sessions; the framework logged access to more than one million member records, roughly 31,000 CRM contacts and staff password hashes.
• A semiconductor company: A brute-forced production credential valid across multiple accounts led to new administrator accounts and a persistent API token in production.
• A defense-policy program: An open backend registration endpoint exposed roughly 500 user records, including .mil and .gov addresses.
• Five content-management systems: Tens of thousands of records were accessed, including employee data at a semiconductor-lithography manufacturer, roughly 150,000 internal documents at an industrial-automation manufacturer, and student data at an education nonprofit.

One operation against a semiconductor equipment supplier came preloaded with VPN gateway addresses, group names and shared group passwords — evidence the attackers supplied human-gathered intelligence beforehand.

Old vulnerabilities, radically new economics

Every flaw exploited is familiar: authentication bypasses, insecure direct object references, mass-assignment privilege escalation, weak and default credentials, exposed cloud APIs and old public CVEs. Unit 42's assessment is blunt: autonomous AI raised the volume and coverage of exploitation but not its complexity.

The strategic shift is cost. Operator hours used to cap how many targets one attacker could work; here, likely one person worked 19 at once. The researchers expect more such campaigns as open models with weak guardrails against offensive use grow stronger.

The attribution rests on three lines of evidence: tasking instructions, operational objectives and authorization files written in Chinese; exclusive use of Chinese AI models; and a target set — semiconductor supply chain, U.S. defense and policy, human rights and civil society — that aligns with established Chinese state intelligence priorities.

A second campaign put a price tag on autonomous hacking

This is not the only operation to weaponize Cairn. Separate research from Gambit Security, NorForge and reporting by Reuters in October 2026 described a financially motivated, Chinese-speaking campaign that used Cairn alongside other AI harnesses (Hermes, Strix) and models including Anthropic's Claude Code against more than 1,200 e-commerce sites in the U.S., Canada, Australia and Japan between September 25 and early October.

Reuters reported that campaign breached more than 100 companies for roughly $5,000 in AI tokens — about $50 per successful breach. Dark Reading, citing Gambit Security, reported at least 27 companies compromised, at least 600,000 payment-card records stolen and skimmers installed on five sites, at an average of $25.46 per completed target.

The campaigns differ in intent, tooling and model choice. What they share is Cairn — a legitimate framework repurposed for autonomous intrusion with minimal human oversight.

What should defenders do now?

Unit 42 stresses that every vulnerability exploited here is known and defensible; the urgency comes from pace, since AI agents can probe patiently for 23 hours or more per target at near-zero marginal cost. The recommended priorities: patch internet-facing applications, harden session stores and legacy PHP/Zend code, hunt for web shells, rotate exposed secrets, map third-party sites carrying the brand, and tune detection for sustained adaptive probing that differs from traditional scanner sweeps.

Unit 42 published two indicators for this campaign: the Hong Kong Cairn server, 154.44.31.4, and a U.S. staging and egress node, 82.29.129.54. As cheap, patient, autonomous probing becomes routine, the cheapest defenses — patching and identity hygiene — remain the ones most attackers will test first.

By Olivia Hart