Attackers used an AI tool to breach 10 of 19 target organizations

Unit 42, a team at Palo Alto Networks, found that attackers who speak Chinese used Cairn in August and September 2026. Cairn is an open-source AI tool for tests of computer defenses. The attackers made 25 operations against 19 or more organizations and got access or data at 10. Unit 42 thinks one person or a small team did this.

How it works

Cairn gives an intrusion to an AI model. The model selects the next step and does it. Then it records the result as a new fact. It continues until the goal is done or the operator stops it. One operation continued for more than 50 hours.

The numbers

Unit 42 found these targets:

• the supply chain of semiconductors and advanced manufacturing
• defense and defense policy
• human rights and civil society groups

The attackers used Zhipu GLM 5.2 in 13 operations and DeepSeek V4 Flash or Pro in 12. At a union of teachers in the US, the tool logged access to more than one million member records.

What is not known

Unit 42 has moderate confidence that this is intelligence collection by a group that links to China. It says the weak points were known types, and AI increased the number of attacks but not how hard they are.

Insight: A test claim opens AI models for attackers

The Cairn prompts tell the model to refuse no task. The attackers added a claim of approved testing, and the models did not refuse. In October 2026, a ransomware operator also rewrote refused instructions as an approved red team test. This reads as a pattern: a test claim opens a model, and a refusal by the model is not a defense. Plan for more attacks from each attacker.