AnalysisPublished 12 Nov 2026

Attackers Use Autonomous AI to Target Semiconductor, Defense and Civil Society Sectors

Source Palo Alto Unit 42

Description

Between August and September 2026, Chinese-speaking attackers used the open-source AI penetration testing framework Cairn, combined with Chinese AI models Zhipu GLM and DeepSeek, to autonomously conduct 25 operations against at least 19 organizations in semiconductor manufacturing, U.S. defense policy, and civil society sectors. These attacks resulted in unauthorized access or data retrieval at 10 organizations, including credential theft, exposure of over one million personal records, retrieval of military and government identities, creation of persistent admin accounts, and modification of industry documents. The attackers used Cairn to autonomously plan and execute multi-stage attack operations with minimal human intervention. This activity is assessed with moderate confidence as China-nexus intelligence collection tracked as CL-STA-1238.

Impact

The attacks resulted in unauthorized access to sensitive systems and data at 10 targeted organizations. Impacts included theft of dozens of valid credentials, exposure of over one million personal data records at one organization, retrieval of military and government identities, creation of persistent administrator accounts in production systems, and unauthorized modification of industry standards documents. These impacts indicate significant compromise of confidentiality, integrity, and potentially availability in critical sectors. The activity is linked to China-nexus intelligence collection efforts.

Defensive guidance

No specific patch or fix applies as this is an adversary campaign using publicly available AI tools. Organizations should leverage advanced threat detection and prevention solutions such as Palo Alto Networks' Advanced URL Filtering, Advanced IP Defense, Cortex XDR, XSIAM, and Agentic Endpoint Security. Identity and access management solutions like Idira IAM and PAM can help mitigate credential theft and privilege escalation risks. Engaging with specialized services such as Unit 42 AI Security Assessment, Continuous Frontier AI Defense, and Incident Response can assist in identifying and mitigating AI-enabled threats. Monitoring for unauthorized access and anomalous activity consistent with autonomous AI-driven attacks is recommended.

Summary

The threat actors leveraged the open-source Cairn AI agent framework, enhanced with Chinese AI models Zhipu GLM 5.2 and DeepSeek V4 variants, to autonomously conduct penetration testing-style attacks against targeted organizations. Cairn orchestrated multi-stage operations including reconnaissance, exploitation, credential harvesting, privilege escalation, lateral movement, and persistence. The attackers supplied high-level goals and let Cairn plan and execute tasks, iterating through reasoning and exploration phases until objectives were met or options exhausted. The campaign targeted advanced semiconductor manufacturing, U.S. defense policy, and civil society sectors, achieving unauthorized access and data exfiltration in multiple cases. The attackers operated Cairn from infrastructure in Hong Kong and the U.S., and used custom skill packs and authorization preambles to ensure the AI agents did not refuse tasks. This represents a novel use of autonomous AI agents for offensive cyber operations with significant operational scale and impact.

References

unit42.paloaltonetworks.com/cairn-framework-ai-autonomous-attacks/ (opens in a new tab)

Community reviews

Loading reviews…

Description

AI analysisMachine-generated, updated 12 Nov 2026, 15:19 UTC

Technical details

References

Community reviews