Palo Alto Networks’ Unit 42 says a suspected China-nexus operator used a fork of the open-source Cairn AI pentest framework to run 25 largely autonomous intrusions, and got in at 10 of the 19 organisations it targeted. None of the weaknesses it exploited were new. What changed is how many targets one small team could work on at the same time.
What happened
On 12 November 2026, Unit 42 published its analysis of a campaign it tracks as CL-STA-1238. Over August and September, the operators gave an AI-driven attack framework a target domain and a one-line objective, then mostly left it alone. Across 25 operations against at least 19 organisations, the framework mapped attack surfaces, chose its own exploitation routes and recorded what worked. Unit 42 confirmed unauthorised access or data retrieval at 10 of those organisations.
Seven targets belonged to the chip supply chain, from lithography and photomasks to materials and a standards body. Three were in defence or defence policy, including a space technology firm and a think tank. Four were civil society groups, among them a Canadian human rights body and a US teachers’ union.
The outcomes were real. Password spraying against the standards organisation yielded dozens of working logins, and a cloud storage location that accepted anonymous writes let the attackers replace a live ballot document. One chip firm lost a guessed production password, after which the agent planted fresh admin accounts and a long-lived API token. A sign-up flaw at the teachers’ union exposed over a million member records plus staff password hashes, and an open registration endpoint on a defence policy platform leaked about 500 user records, some on .mil and .gov domains.
Unit 42 attributes the activity, with moderate confidence, to China-nexus intelligence collection. It cites Chinese-language tasking, Chinese AI models and a target list matching Beijing’s priorities, and thinks one person or a small team ran the lot. This is a separate investigation from NorForge’s October research into exposed Cairn control panels, including the cluster it calls AIA0001.
The technical picture
Cairn works with any model. A language model drives each “agent worker”, and workers share a blackboard where proven findings are stored as facts and planned steps as intents. Operators can add hints, but otherwise the model alternates between reasoning over what it knows and taking one action, until it decides it is done or is stopped. Plans ran to between three and seven stages, and individual runs lasted between 20 minutes and upwards of 50 hours.
The attackers ran their customised fork from a Hong Kong server, with a separate US node for staging and egress. Their build carried an extra exploitation module, “AIScan Runner Skills”, absent from the public project. Zhipu GLM 5.2 powered 13 operations; DeepSeek V4 Flash and V4 Pro handled the remaining 12, with Pro apparently reserved for targets that beat Flash.
Guardrails were barely an obstacle. Cairn’s own prompts forbid refusals; the operators layered on a Chinese-language claim that all work was sanctioned testing, plus a generated authorisation file in Markdown, and Unit 42 says neither model objected. Humans still helped: one task against an equipment supplier was seeded with VPN gateways and shared group passwords collected in advance.
Every weakness used was ordinary: broken authentication, IDOR, mass assignment, weak or default passwords, exposed cloud APIs and old CVEs. In Unit 42’s words, autonomous AI “raises the volume and coverage of exploitation, but not its complexity.”
Why it matters for UK organisations
No UK victim is named, but the target profile maps neatly onto British chip design firms, the defence supply chain, standards and membership bodies, universities and charities. All run the member portals and content management systems this campaign went through, often untested.
The bigger lesson is about economics. Defenders have quietly relied on attackers’ limited time: a mid-tier firm could assume it was not worth the effort. That assumption is gone. When the costly part of an intrusion is handed to a model API, an attacker can probe every organisation in a sector in parallel and keep going for days. Justin Greis of Acceligence told CSO Online that an organisation’s “risk can rise even when its vulnerabilities haven’t changed.”
The overwritten ballot also deserves attention from anyone covered by the Cyber Security and Resilience Bill or relying on data integrity for regulated decisions. This campaign did more than steal data. It quietly changed a record people would later trust.
Expert view
When we run web application and external infrastructure tests, the findings that give us a foothold are seldom exotic. They are usually a forgotten registration endpoint, an object reference nobody checked, or a shared VPN group password that has outlived three staff changes. That is exactly the list Unit 42 describes, and it is reassuring in a way. Nothing here needed a zero-day, and every route in was something a competent assessment should have caught.
In my experience, the uncomfortable part is coverage, not capability. Most organisations test their crown-jewel applications once a year and never look at the long tail of marketing sites, member portals and partner integrations. An autonomous agent does not prioritise the way a human tester does. It will patiently try every subdomain it finds. Your attack surface inventory now has to be as thorough as theirs.
I would not rely on model providers refusing this work either. A one-paragraph claim of authorisation sufficed; assume capable offensive agents are freely available.
What to do now
- Inventory your external estate. List every domain, subdomain, portal and cloud storage endpoint, including those run by agencies and partners. An agent starting from your root domain will find them all (Cyber Essentials: firewalls and secure configuration).
- Kill weak and shared credentials. Enforce MFA on every internet-facing login, ban default passwords, retire shared VPN group secrets and add lockout or rate limiting to stop spraying and brute force (user access control).
- Test the long tail. Put member portals, CMS instances and registration flows in scope for testing, focusing on authorisation flaws such as IDOR and mass assignment, which scanners often miss.
- Lock down cloud storage. Check that no bucket or blob container accepts unauthenticated writes, and turn on versioning so tampered files can be recovered.
- Patch the old stuff. Dated public CVEs were on the list. Treat anything internet-facing that is behind on patches as a priority (security update management).
- Watch for new admins and tokens. Alert on newly created privileged accounts, API tokens and changes to critical documents, and practise restoring trusted versions.
- Block the published indicators. Add 154.44.31[.]4 and 82.29.129[.]54 to blocklists and search past logs for contact with them.
Bottom line
CL-STA-1238 shows that autonomous AI intrusion is operational: an off-the-shelf framework, commodity models and a trivial jailbreak pretext achieved access or data retrieval at ten organisations. The good news for UK defenders is that every door it opened was a known one. The bad news is that an attacker can now try every door at once, so the gaps you were hoping nobody would bother with need closing now.
