Autonomous AI Framework Cairn Powers Cyberattacks on 19 Organizations Across Critical Sectors
Hari 
Unit 42 has attributed a campaign of 25 autonomous intrusion operations against at least 19 organizations to a China-nexus cluster tracked as CL-STA-1238.
Between August and September 2026, the operators used the open-source AI penetration testing framework Cairn, paired with the Chinese models Zhipu GLM and DeepSeek. Researchers assess with moderate confidence that the activity is intelligence collection. Unauthorized access or data retrieval was confirmed at 10 of the targets.
Autonomous AI Framework
Cairn coordinates AI-driven agent workers through a shared blackboard, which stores a fact-intent graph. Confirmed findings persist as immutable facts, while each agent queues its next actions as intents. Human operators can inject hints at any point.
The operators ran a customized fork from a Hong Kong server at 154.44.31[.]4 and staged egress through a U.S. node at 82.29.129[.]54. This autonomous orchestration echoes the first widely disclosed breach executed end-to-end by an AI agent system at Hugging Face, which began in a dataset-processing pipeline.
Each operation started with a one-line Chinese goal, and a bootstrap task attempted to satisfy it directly from the seeded root domain. Cairn then decomposed the objective into three to seven stages.
These covered reconnaissance and asset mapping, web application exploitation, middleware exploitation, credential and secret harvesting, privilege escalation with lateral movement, and persistence.
A Reason phase evaluated accumulated facts, and an Explore phase executed a single action and wrote the result back. Operations ran from 20 minutes to more than 50 hours with no imposed time limit.
The operators ran 13 operations on GLM 5.2, eight on DeepSeek V4 Flash and four on DeepSeek V4 Pro. They appear to have escalated to the Pro tier when targets resisted Flash. Every run also loaded a custom skill pack named AIScan Runner Skills, which does not exist upstream.
Agentic tooling of this kind also appears in legitimate offensive work, such as PortSwigger’s Burp AT agentic layer, which keeps scope enforcement outside the model.
Guardrail bypass was trivial. Cairn’s stock worker prompts already forbid refusal, and the operators prepended a Chinese preamble asserting an authorized security-testing scenario. Each run also generated an AUTHORIZATION.md file that treated task creation as client approval. Neither GLM nor DeepSeek declined this pretext.
Targeting centered on seven semiconductor supply-chain organizations, three defense and policy entities, and four human rights and civil society groups. One semiconductor equipment supplier task included preloaded VPN gateway addresses and shared group passwords, which indicates prior intelligence gathering.
The confirmed intrusions relied on weak-password spraying, brute-forced production credentials, unauthenticated account-creation bypasses, open registration endpoints and unauthenticated cloud-storage writes. At a standards body, the framework overwrote a live ballot document and harvested dozens of valid credentials.
At a semiconductor company, it created persistent administrator accounts and an API token. At a teachers’ union, it exposed more than one million member records, roughly 31,000 CRM contacts and staff password hashes.
None of the flaws was novel. The flaws included authentication bypasses, insecure direct object references, mass-assignment privilege escalation, default credentials, exposed cloud APIs and dated public CVEs.
Autonomy changed the scale of the operation rather than its sophistication, since a single operator or small team ran simultaneous intrusions against 19 organizations in two weeks.
Because credential abuse drove most of the outcomes, defenders should prioritize phishing-resistant authentication, and hardware-backed passkeys such as YubiKey 5.8 address authorization as well as login.
Defenders should block the published indicators, enforce least privilege, rotate shared secrets, remove default credentials and eliminate unauthenticated write paths. Unit 42 expects model-driven intrusion campaigns to grow more common as open models with weak offensive guardrails become more capable.
Site: Thecyberdef.com
Follow TheCyberDef on Google News, LinkedIn & X for the latest cybersecurity updates. Stay informed.
About the Author
Kiran