Unit 42Unit 42
Unit 42 says autonomous AI targeted 19 organisations
Unit 42 reports that between August and September 2026, actors using an open-source AI penetration testing framework called Cairn autonomously conducted 25 operations against at least 19 organisations. They paired Cairn with Chinese AI models Zhipu GLM 5.2 and DeepSeek V4 Flash/Pro, feeding targets and goals that Cairn then interpreted, planned, executed and recorded.
The researchers say Cairn’s workflow uses a shared blackboard, with confirmed findings stored as immutable facts and each operation proceeding through bootstrap, reason and explore phases. In one semiconductor manufacturer, Cairn’s stages moved through reconnaissance, web application and services exploitation, credential harvesting, privilege escalation, lateral movement and persistence, with individual operations lasting from 20 minutes to more than 50 hours.
The study identifies 10 confirmed outcomes across three sectors: advanced semiconductor manufacturing, US defence policy, and civil society. Outcomes included exposure of dozens of credentials, mass data retrieval (at least one organisation exceeded one million records), access to military and government identities, creation of persistent administrator accounts, and even modification of a live standards-ballot document.
The researchers flag that many attacks were enabled by identity and configuration weaknesses, such as weak credentials, authentication bypasses and exposed cloud APIs, describing the activity as China-nexus intelligence collection (CL-STA-1238) with moderate confidence. They note that Cairn was run from a Hong Kong server with a US staging node and that anAUTHORIZATION[.]md file accompanied operations, asserting authorised engagement.
Indicators of compromise include Cairn hosting and staging servers: 154.44.31[.]4 in Hong Kong and 82.29.129[.]54 in the United States. Unit 42 stresses that autonomous AI can expand threat reach and pace, while underscoring that basic hygiene—identity management, surface reduction and patching—remains essential.