> Palo Alto tracks a massive Chinese AI attack that sadly lives up to industry fears

Palo Alto Networks Unit 42 is reporting today that it has tracked a massive China-based attack leveraging the open-source AI penetration testing framework Cairn to autonomously conduct 25 operations against at least 19 organizations. The attackers weaponized Cairn by pairing it with Chinese AI models Zhipu GLM and DeepSeek, Unit 42 said. The report said it monitored the attacks in August and September 2026 in which the Chinese-speaking attackers were able to successfully achieve unauthorized access at 10 of the targeted businesses, accessing dozens of valid credentials. It captured more than one million records at one business, grabbed military and government identities at others, created persistent admin accounts in multiple product systems. It even gained unauthenticated access to cloud storage and overwrote a live ballot for a vote on an industry standard. Through separate flaws, the attackers logged in as arbitrary customers and gained read, write and delete access to meeting, voting and back-office functions. “What a nightmare,” said Frank Dickson, principal analyst at Dickson Research. “This campaign is impressive, in the worst way.” He viewed the detailed approach Unit 42’s threat researchers used in tracking the attacks with approval. Unit 42 “took the machine apart and showed how it thinks: the shared blackboard, the facts, the intents, the human hints, and even the exact prompts the attackers used,” he said. “The expensive part of an intrusion was always the labor: the reconnaissance, the trial and error, and the patience. That labor is now a line item on an API bill. Unit 42 believes one person or a handful of people ran all of it, hitting 19 organizations in two weeks. Some operations ran for more than 50 hours.” Andy Piazza, senior director of threat research at Unit 42, said the monitored campaign showed that the massive scope of a global AI-fueled assault is every bit as frightening as predicted. “We are now starting to see the evidence” because the monitored campaign “can now interact with 1,000 organizations at the same time,” Piazza said. “I think we need to throw out the risk model for the perimeter. This also completely breaks our attribution models. The fingerprinting of attack uniqueness is going to be a hell of a lot harder now.” Justin Greis, CEO of consulting firm Acceligence, added that he was concerned about this campaign because of the scope of activities that AI is now able to handle. “This is significant because AI is taking on the coordination of an intrusion, using each result to decide what to try next and reducing the hands-on effort required to pursue multiple targets,” he said. “That changes the economics of targeting. An attacker can sustain pressure across more organizations without personally directing every step. An organization’s risk can rise even when its vulnerabilities haven’t changed.” Greis noted that the altered ballot deserves attention because it shows how an intrusion can undermine the information people rely on to make decisions. “Alongside detecting data theft, CISOs should monitor unauthorized changes to critical records and privileged access and test their ability to verify and restore trusted information after an incident,” he said. “Resilience includes knowing that the information you are using to run the business can still be trusted.” The model’s process The report included a detailed description of the campaign’s methodology. “Cairn coordinated its activities through a shared blackboard,” it said. “Agents read the blackboard and wrote their findings back as a fact-intent graph, while human operators can inject hints at any time to help guide the operations if needed. Confirmed findings accumulate as immutable facts and the agent queues its next actions as intents. Attackers ran a customized fork of Cairn from a server hosted in Hong Kong, and hosted an attack egress and staging node in the US.” The model produced a different plan for each target, each running between three and seven stages, the researchers explained. Individual operations ran from 20 minutes to more than 50 hours, with no attacker-imposed time limit. Chinese AI Models Cairn is model-agnostic, they noted, and the attackers ran their operations on the Chinese models Zhipu GLM 5.2 and DeepSeek V4 Flash/Pro. The report also described attackers’ efforts to negate systems attempting to prohibit the unauthorized activities. “Cairn’s stock worker prompts already instruct the model to never refuse a task,” it said. “The attackers reinforced this with an authorization pretext of their own. Each operation also generated an authorization.md file. This file declared the operation authorized, treating the attackers’ act of creating the task as a client-approved engagement. The attackers seeded each task with an organization’s root domain, allowing the framework to autonomously enumerate the attack surface.” “We knew attackers would get here. We hoped it was not now,” Dickson said. “AI attack agents have graduated from failed experiments to real breaches, and they did it in about three months.”