Unit 42 says Chinese-speaking attackers ran 25 intrusions with the Cairn AI agent framework
From August to September 2026 the attackers paired the open-source Cairn pentest framework with Zhipu GLM and DeepSeek models against at least 19 organizations, getting access or data at 10, Palo Alto Networks' Unit 42 said.
Why it matters
The report describes operators giving the agents only a target and a goal, after which Cairn planned, ran and logged each step, with single operations lasting from 20 minutes to more than 50 hours. Targets included advanced semiconductor makers, U.S. defense-policy groups and civil society. Unit 42 tracks the cluster as CL-STA-1238 and links it to China-nexus intelligence collection with moderate confidence, based on language artifacts, model choice and targeting rather than proof of a state sponsor. Watch for responses from Cairn's maintainers and the model providers.
Key facts
- 25 autonomous operations against at least 19 organizations
- Activity ran August–September 2026
- 10 organizations saw unauthorized access or data retrieval
- More than one million personal records exposed at one organization
- Models used: Zhipu GLM 5.2 and DeepSeek V4 Flash/Pro
- Tracked as CL-STA-1238, moderate confidence China-nexus