Unit 42 reported that Chinese-speaking attackers used an open-source AI penetration testing framework called Cairn to autonomously conduct 25 operations against at least 19 organizations between August and September 2026.
Autonomous Operations
Unit 42 said the attackers weaponized the Cairn penetration testing framework by pairing it with Chinese AI models Zhipu GLM and DeepSeek. The attackers supplied a target and a goal, allowing Cairn to plan, execute, and record results on its own.
The framework ran operations through bootstrap and orchestration loops, consisting of a Reason phase and an Explore phase. Individual operations ran from 20 minutes to more than 50 hours without an attacker-imposed time limit.
Targeted Sectors and Outcomes
According to Unit 42, the campaign targeted organizations concentrated in semiconductor and advanced-manufacturing supply chains, defense and defense policy, and human rights and civil society.
The attacks achieved unauthorized access or data retrieval at 10 of the targeted organizations, including accessing dozens of valid credentials, exposing over one million personal records at one organization, and modifying a live industry standards-ballot document.
Key facts and where they come from
- Attackers used the Cairn framework to conduct 25 operations against at least 19 organizations.
Chinese-speaking attackers used an open-source AI penetration testing framework called Cairn to autonomously conduct 25 operations against at least 19 organizations.
- The attackers paired Cairn with Chinese AI models Zhipu GLM and DeepSeek.
The attackers weaponized Cairn by pairing it with Chinese AI models Zhipu GLM and DeepSeek.
- The attacks achieved unauthorized access or data retrieval at 10 targeted organizations.
These attacks achieved unauthorized access or data retrieval at 10 of the targeted organizations
The catch
- The announcement does not say whether the attackers were affiliated with a specific government.
- Unit 42 states the attribution to China-nexus intelligence collection is made with moderate confidence.
The open question: Can organizations effectively defend against autonomous AI penetration testing frameworks using traditional security postures?
Tell us what you think · Discuss it in the Threat Intel room
Reader poll: Should security teams adopt defensive autonomous AI tools to counter AI-driven attacks?
A show of hands from readers, not a scientific poll. Say why in the comments.
