Unit 42: suspected China-nexus spies used AI agents to break into 10 of 19 targeted organizations

On November 12, 2026, Palo Alto Networks' Unit 42 reported that a group it tracks as CL-STA-1238 used an open-source AI penetration-testing framework, Cairn, to run 25 largely autonomous intrusion operations against at least 19 organizations in August and September 2026, getting in or taking data at 10 of them. The targets were semiconductor suppliers, defense organizations and civil-society groups; Unit 42 assesses with moderate confidence that this is China-nexus intelligence collection. The way in was not new: weak and shared passwords, open registration pages and unprotected cloud storage — so the fix is basic hygiene, done faster.

What happened, in plain English

A penetration test ("pentest") is a hired, authorized attempt to break into a company to find its weak spots. Cairn is a free, open-source program on GitHub that lets AI "agents" do this work. An agent is an AI model allowed to act, not just chat: it runs a tool, reads the result and decides its next step. Several agents share a common "blackboard" where they write down what they have found and what they plan to try next, and a human can drop in hints along the way.

According to Unit 42, the attackers ran a customized copy of Cairn from a server in Hong Kong, with an attack server in the US. For each target they typed in the organization's main domain name — sometimes with extra details gathered earlier, such as VPN (virtual private network) gateway addresses and shared group passwords — and let the agents work for anything from about 20 minutes to more than 50 hours.

The AI models were Chinese: Zhipu GLM 5.2 in 13 operations and DeepSeek V4 Flash and V4 Pro in the rest. To stop the models from refusing, the attackers told them in a Chinese-language preamble that this was an approved security test, and each operation even created a file called AUTHORIZATION.md declaring itself authorized. Unit 42 says neither model refused.

Think of it as a burglar hiring a crew of tireless apprentices who try every door and window on the street, all night — not with new lock-picking tricks, but by patiently checking which doors were left unlocked.

The results, per Unit 42: dozens of valid passwords and directory data from an industry standards body, where a live ballot document was overwritten; new administrator accounts and a lasting API token inside a semiconductor company's production system; more than one million member records and staff password hashes from a US teachers' union; and about 500 user records, including .mil and .gov accounts, from a defense-policy platform.

Are you affected? What to do now

Unit 42 did not name the victims. Seven targets were in the semiconductor and advanced-manufacturing supply chain (lithography, chip design, materials, photomasks, standards), three in defense and defense policy, and four in human rights, education and civil society. If you work in or supply those sectors, treat this as directly relevant. For everyone else, the lesson still applies: these agents only found doors that were already open.

Checklist:

• Hunt for weak and shared passwords on internet-facing apps. Password spraying (trying a few common passwords against many accounts) and brute-forcing worked here. Require MFA (multi-factor authentication) on every external login, including partner and integration portals, and ban one password shared across several accounts or a whole group.
• Review VPN group credentials. One supplier was hit with pre-collected VPN gateway addresses and a shared group password. Move to per-user credentials with MFA and rotate any shared secret.
• Close open sign-up and back-end endpoints. Unit 42 lists an open back-end registration endpoint on an identity platform and an account-creation bypass in a content management system (CMS). Check that self-registration is switched off where nobody needs it and that admin APIs require authentication.
• Audit cloud storage permissions. One intrusion used an unauthenticated write to cloud storage. Look for buckets or containers that allow anonymous write or list.
• Look for the post-access traces. Review recently created admin accounts and long-lived API tokens in production systems, and unexpected bulk exports of member or CRM data.
• Patch old, public bugs. The report cites "dated public CVEs" among the weaknesses. Clear your backlog of known internet-facing flaws first.
• Check the published indicators. Unit 42 published two IP addresses: 154.44.31[.]4 (Hong Kong, Cairn controller) and 82.29.129[.]54 (US, staging and attack egress). Search firewall, VPN and web logs for them from August 2026 onward. No hashes or domains were published.
• Shorten your response time. Some operations ran unattended for more than two days. Alerts reviewed weekly are too slow.

The expert view

Unit 42's own summary is the honest one: autonomous AI "raises the volume and coverage of exploitation, but not its complexity." Every weakness in the report is a classic — authentication bypasses, insecure direct object references (changing an ID in a request to see someone else's data), mass-assignment privilege escalation (sending extra fields that an app trusts and uses to make you admin), default credentials and exposed cloud APIs. No zero-days, no novel malware.

What changes is the economics of attention. A human operator choosing between 19 targets has to prioritize. A loop of "reason, then try one action, then record the result" does not get bored and does not need to prioritize: it can grind through every endpoint of every target in parallel, with a human stepping in only to add intelligence such as stolen VPN details. Unit 42 thinks this was likely a single operator or a small team. That ratio — one person, ten successful intrusions across strategic sectors in about two months — is the real news.

It also continues a pattern we have covered. In October, NorForge found Cairn dashboards left open on the internet by apparently financially motivated groups attacking online shops. Unit 42 does not link CL-STA-1238 to that activity; what is shared is the tool, not, as far as anyone has shown, the operators. The shift is in purpose: the same off-the-shelf harness now appears in what Unit 42 assesses as intelligence collection.

On guardrails, the report is blunt: "The building blocks of this campaign were an off-the-shelf open-source framework, commodity model APIs and a trivial jailbreak pretext." According to Unit 42, Cairn's own stock prompts already tell the model not to refuse, and a one-paragraph "this is authorized" claim was enough on top. Model-side refusals that rely on the user's stated intent are not a meaningful control when the attacker writes the intent. Defenders should plan as if capable, unrestricted agent tooling is freely available — because it is.

Attribution deserves care. Unit 42's moderate-confidence China-nexus assessment rests on Chinese-language artifacts (tasking, objectives and authorization files), exclusive use of Chinese models and target choices it says match Chinese state intelligence priorities. Those are reasonable signals but circumstantial; no government has made an attribution, and Unit 42 names no specific group beyond its own cluster label.

What is still unknown:

• Victim identities and notification. The report names no victims and does not say whether they were notified or whether the activity continues.
• The custom skills pack. Each operation loaded an "AIScan Runner Skills" pack not found in the public Cairn project. Unit 42 does not describe its contents.
• Detection. The report gives no behavioral detection rules — only the two IP addresses and general advice on identity hygiene, attack-surface reduction and patching.
• Provider response. We found no statement from Zhipu or DeepSeek.

Official sources

• Palo Alto Networks Unit 42 — "Attackers Use Autonomous AI to Target Semiconductor, Defense and Civil Society Sectors" (November 12, 2026)
• Coverage: CSO Online — "Palo Alto tracks a massive Chinese AI attack…" (November 12, 2026)
• Coverage: Cybersecurity Dive — "China-nexus actor uses AI tool in campaign targeting US defense, semiconductor industries" (November 13, 2026)
• Earlier on AI Cyber Brief: Exposed control panels show AI agents running 1,100+ break-in attempts on online shops