Threat watch / Campaign
Cairn: an AI pentest framework turned against 19 organizations, 10 of them breached
On November 12, 2026, Palo Alto Networks Unit 42 reported 25 operations run in August and September 2026 with a customized fork of Cairn, a public AI penetration testing framework, against at least 19 organizations in the semiconductor and advanced-manufacturing supply chain, defense policy and civil society. Unit 42 confirmed unauthorized access or data retrieval at 10 of them. The operations ran on Chinese AI models, Zhipu GLM 5.2 and DeepSeek V4, which did not refuse the attackers' fake authorization preamble. Unit 42 assesses with moderate confidence that this is China-nexus intelligence collection, tracked as CL-STA-1238.
- Sector
- Many sectors
- Way in
- Not public yet
- Product or vendor
- None named
- How it happened
- The way in differed from target to target. At an industry standards body, weak-password spraying against an internet-facing application server gave dozens of valid credentials. At a semiconductor company, a brute-forced production credential on a partner-integration application was valid across several accounts. At a U.S. teachers' union, an unauthenticated account-creation bypass in the content management system let the framework mint valid sessions. A defense-policy program exposed an open registration endpoint on its identity platform. Unit 42 sums up the weaknesses used as authentication bypasses, insecure direct object references, mass-assignment privilege escalation, weak and default credentials, exposed cloud APIs and old public CVEs.[1][2] Checked 13 Nov 2026
- What was stolen
- At the teachers' union, the framework logged access to more than one million member records, about 31,000 CRM contacts and staff password hashes. At the defense-policy program, about 500 user records, including accounts with .mil and .gov addresses. At the semiconductor company, application data, user lists and email lists; the attackers also created administrator accounts and a persistent API token. At the standards body, internal directory data; a live standards-ballot document was overwritten. In other cases, tens of thousands of content-management records, including about 150,000 internal documents at an industrial-automation manufacturer.[1][2] Checked 13 Nov 2026
- Who was impacted
- At least 19 targeted organizations, which Unit 42 does not name: seven in the semiconductor and advanced-manufacturing supply chain, three in defense or defense policy and four in human rights and civil society. Unauthorized access or data retrieval was confirmed at 10 of them, including a U.S. teachers' union and its members.[1][2] Checked 13 Nov 2026
- Threat actor
- CL-STA-1238 →
Timeline
- In August and September 2026, 25 operations run with a customized fork of Cairn, loaded with an "AIScan Runner Skills" pack that is not in the public project, target at least 19 organizations. Each operation lasts from 20 minutes to more than 50 hours. 13 run on Zhipu GLM 5.2, 8 on DeepSeek V4 Flash and 4 on DeepSeek V4 Pro. [1]
- Unit 42 publishes its analysis. The attackers added a Chinese-language authorization preamble to the system prompt and generated an AUTHORIZATION.md file for each operation; "Neither Zhipu GLM nor DeepSeek refused this framing." Unit 42 assesses "with moderate confidence" that the activity is China-nexus intelligence collection, tracked as CL-STA-1238, likely run by a single operator or small team. [1][2]