Chinese-Speaking Attackers Leverage Cairn AI Framework for Targeted Cyber Operations

Between August and September 2026, Chinese-speaking attackers executed 25 operations against at least 19 organizations using an open-source AI penetration testing framework known as Cairn. By integrating Cairn with Chinese AI models Zhipu GLM and DeepSeek, the attackers were able to autonomously plan, execute, and document their operations.

The attackers provided Cairn with specific targets and objectives, resulting in unauthorized access or data retrieval at 10 of the targeted organizations. Notable outcomes included:

• Access to dozens of valid credentials.
• Mass exposure of personal data, exceeding one million records at one organization.
• Retrieval of military and government identities.
• Creation of persistent administrator accounts within production systems.
• Modification of a live industry standards ballot document.

Palo Alto Networks assesses with moderate confidence that this activity is linked to intelligence collection efforts associated with China, tracked as CL-STA-1238. The article outlines how Cairn was used to target three critical sectors:

• Advanced semiconductor manufacturing.
• U.S. defense policy.
• Civil society.

Palo Alto Networks offers various products and services to enhance protection against these threats, including Advanced URL Filtering, Cortex XDR, and Identity and Access Management solutions.

Cairn Framework Overview

The attackers utilized the publicly available Cairn framework to orchestrate their campaign. Each Cairn agent is driven by an AI model, coordinating activities through a shared “blackboard.” Agents can read and write findings, while human operators can provide hints to guide operations.

The attackers operated a customized version of Cairn from a server in Hong Kong and used a staging node in the U.S. for their operations. Each operation began with a task that outlined a specific goal, such as obtaining high-value access to various systems.

Operational Insights

During the attacks, Cairn executed a series of tasks that included reconnaissance, exploitation of web applications, credential collection, and privilege escalation. The orchestration loop of Cairn consists of reasoning about findings and exploring new actions until the goal is achieved or options are exhausted.

The attackers conducted operations using Chinese AI models, running 13 operations on Zhipu GLM 5.2 and 12 on DeepSeek, with a skill pack named “AIScan Runner Skills” enhancing the framework’s scanning and exploitation capabilities.

Targeting and Outcomes

The attackers targeted organizations across three primary categories: semiconductor manufacturing, defense policy, and civil society. Each operation was named in Chinese, clearly stating the intent, and tasks were seeded with specific information about the target environment.

Confirmed outcomes included unauthorized access to sensitive data across various sectors, such as:

• Weak-password spraying against an industry standards organization, leading to credential theft.
• Brute-force attacks on a semiconductor company that resulted in unauthorized administrator account creation.
• Exploitation of a content management system at a U.S. teachers’ union, yielding access to over one million member records.

Attribution and Future Implications

Unit 42 assesses that CL-STA-1238 represents a China-nexus intelligence collection campaign, supported by evidence such as the use of Chinese language in operational instructions and the selection of targets aligned with Chinese state intelligence priorities.

This campaign highlights a shift in how attackers are applying AI to offensive operations. The use of an open-source framework and AI models allows for simultaneous targeting of multiple organizations, increasing the scale of exploitation while relying on known vulnerabilities.

As autonomous AI capabilities continue to evolve, the potential for similar intrusion campaigns is likely to grow, emphasizing the need for robust identity management, attack-surface reduction, and timely software patching.

Source: Unit 42 Palo Alto