Attackers Use Autonomous AI to Target Semiconductor, Defense and Civil Society Sectors
Chinese-speaking attackers deployed an AI penetration testing framework called Cairn to autonomously conduct 25 operations against 19 organizations in August-September 2026, achieving unauthorized access at 10 targets.
The attackers supplied only a target and a goal, then Cairn autonomously planned, executed and recorded results. These operations resulted in accessing dozens of valid credentials, mass exposing personal data (exceeding one million records at one organization), retrieving military and government identities, creating persistent administrator accounts, and modifying a live industry standards document.
Cairn Framework Mechanics
The attackers used a customized fork of Cairn hosted in Hong Kong, with an attack egress node in the U.S. Each operation began with a bootstrap task attempting to solve the goal directly, followed by the framework mapping the target and breaking the goal into smaller tasks. The AI worker operated through a continuous Reason-Explore loop until meeting the goal or exhausting options.
Obtain substantive high-value access, including but not limited to webshell, SSH, source code, keys, user information, credentials, ideally, to enter the internal network.
AI Models and Guardrails
Cairn ran on Chinese models Zhipu GLM 5.2 and DeepSeek V4 Flash/Pro, with attackers benchmarking the models against each other. They reinforced the framework's inherent guardrails by adding a Chinese-language preamble asserting all tasks were authorized, which neither AI model refused. Each operation also generated an AUTHORIZATION.md file to legitimize the engagement.
Targeted Sectors
The attackers concentrated on three main sectors: semiconductor and advanced manufacturing (seven organizations), defense and defense policy (three organizations), and human rights and civil society (four organizations). Task names included 'comprehensive deep penetration test against ' and 'breach as fast as possible,' with attackers supplying intelligence like VPN gateway addresses and passwords in some cases.
Confirmed Attack Outcomes
Confirmed breaches included an industry standards organization where attackers accessed dozens of valid credentials and overwrote a live standards document; a semiconductor company where attackers created unauthorized admin accounts; a U.S. teachers' union where over one million member records were exposed; and defense-policy organizations where .mil and .gov user records were compromised.
Related
