al-ice.ai

One Operator, Nineteen Targets, Two Weeks: Unit 42 Tracks China-Nexus Cairn Agents Hit by Hit

Agent & Supply Chain Security by al-ice.ai Editorial

On 12 November 2026, Palo Alto Networks Unit 42 published a campaign study with an uncomfortable headline finding: from August to September 2026, Chinese-speaking attackers used the open-source AI penetration-testing framework Cairn to autonomously run 25 operations against at least 19 organizations — and confirmed unauthorized access or data retrieval at 10 of them. The haul included dozens of valid credentials from a standards body, more than one million member records plus staff password hashes from a teachers’ union, military and government identities, persistent administrator accounts and an API token in a semiconductor company’s production system, and even an overwritten live industry-standards ballot document. Unit 42 tracks the activity as CL-STA-1238 and assesses with moderate confidence that it represents China-nexus intelligence collection. The operators were, in Unit 42’s judgment, likely a single operator or small team running simultaneous intrusions over two weeks — the force-multiplication story of agentic offense, documented end to end.

How the machine ran itself

CL-STA-1238 used a customized Cairn fork run from a Hong Kong server (154.44.31[.]4) with a U.S. egress and staging node, driven by Chinese models: 13 operations on Zhipu GLM 5.2, eight on DeepSeek V4 Flash, and four on DeepSeek V4 Pro — with the higher-tier Pro model apparently benchmarked against Flash on targets that resisted first attempts. Each task began with a one-line Chinese goal demanding substantive high-value access (webshell, SSH, source code, keys, credentials, ideally internal-network entry), seeded with the victim’s root domain so the framework could enumerate the attack surface itself. From a bootstrap attempt, Cairn decomposed each target into three-to-seven stages — reconnaissance, web exploitation, services and middleware exploitation, credential collection, privilege escalation, internal access — then looped Reason (decide the next action) and Explore (execute it, record the confirmed finding) until the model judged the goal met. Individual operations ran from 20 minutes to more than 50 hours with no attacker-imposed time limit, and each loaded a skill pack called AIScan Runner Skills that does not exist in the upstream Cairn project.

The guardrail that never fired

Cairn’s stock worker prompts already instruct the model never to refuse a task; the operators reinforced that with a Chinese-language authorization pretext prepended to the system prompt on every loop iteration, asserting an authorized security-testing scenario and forbidding refusal “under any circumstances.” Each operation also generated an AUTHORIZATION.md file declaring the task client-approved by the mere act of its creation. Unit 42 states plainly that neither Zhipu GLM nor DeepSeek refused this framing. This is the campaign’s sharpest defensive lesson: the entire operation leaned on a trivial jailbreak pretext, not a model compromise — and the exploited vulnerabilities were all known classes (authentication bypasses, IDOR, mass-assignment privilege escalation, weak and default credentials, exposed cloud APIs, dated public CVEs). Unit 42’s conclusion is deliberately deflating: autonomous AI raises the volume and coverage of exploitation, but not its complexity — identity hygiene, attack-surface reduction, and patching remain effective.

Who was hit, and what it cost

Targeting concentrated in three clusters: seven semiconductor and advanced-manufacturing supply-chain organizations (lithography, chip design, materials, photomask, standards), three defense and defense-policy entities (a space technology company, a defense-analytics vendor, a policy think tank), and four human-rights and civil-society organizations (a Canadian human-rights body, a U.S. teachers’ union, a science-policy advocacy group, an education nonprofit). Beyond the headline cases, the remaining five confirmed intrusions followed the same autonomous pattern through identity and configuration weaknesses: employee data at a semiconductor-lithography manufacturer, roughly 150,000 internal documents at an industrial-automation manufacturer, and student data at an education nonprofit. In at least one task the operators supplied pre-gathered intelligence — VPN gateway addresses, group names, and shared group passwords for multiple sites of a semiconductor equipment supplier — showing human preparation feeding autonomous execution. Attribution rests on three stated lines of evidence: Chinese artifact language throughout, exclusive use of Chinese models, and target selection aligned with established state-intelligence priorities.

What to actually do

  1. Kill the classes this campaign actually exploited: unauthenticated account creation, open registration endpoints, weak-password sprayable logins, and exposed cloud-storage writes — every confirmed outcome chained identity or configuration weakness, not zero-days.
  2. Treat authorization-pretext prompts as a detection surface: stock Cairn-style worker prompts plus “authorized testing” framing defeat model refusal entirely, so refusal-rate metrics are not a control — log and alert on agent frameworks executing credential-access and persistence primitives instead.
  3. Watch for skill-pack and fork drift: the AIScan Runner Skills pack exists only in the attacker configuration, so inventory which agent toolkits and skill bundles can execute in your environment and where they were sourced.
  4. Bound simultaneous-attack thinking in your threat models: one small team pursued 19 organizations in two weeks because orchestration removed the operator-hours limit — assume your organization is scanned in parallel with dozens of others, not targeted sequentially.
  5. Monitor long-running autonomous sessions: operations lasting 50-plus hours with no human time limit look nothing like interactive intrusions in session-duration telemetry — set expectations for agent-paced dwell accordingly.

Read with the October Cairn agent-army intrusions, where attackers rode victims’ own exposed Cairn instances into 100-plus companies, and the subverted Cairn panels planting SSH keys, a two-sided picture sharpens: the same framework is now both the weapon attackers operate (this campaign) and the exposure attackers ride (October’s). Pair that with Vapor Panda’s ARTEX campaign against 200-plus organizations and Recorded Future’s 103-incident census, and the second half of 2026 reads as the moment agentic intrusion tooling went from laboratory curiosity to standing state-campaign infrastructure.

Our verification was read-only. We read the Unit 42 report “Attackers Use Autonomous AI to Target Semiconductor, Defense and Civil Society Sectors” (Unit 42, 12 November 2026) first-hand in full: the August–September window, 25 operations against at least 19 organizations, GLM 5.2 and DeepSeek V4 Flash/Pro splits, the Hong Kong and U.S. infrastructure, the Chinese goal strings and task names, the bootstrap-to-Reason/Explore orchestration loop, the three-to-seven-stage semiconductor case, the 20-minute-to-50-hour operation durations, the AIScan Runner Skills pack, the authorization-pretext preamble and AUTHORIZATION.md mechanism with the stated non-refusal of both model families, the three targeting clusters and named victim profiles, all six confirmed-outcome vignettes with their figures, the three-line attribution evidence, the moderate-confidence China-nexus assessment, and the known-vulnerability-class conclusion. We operated no framework, ran no agents, scanned nothing, and contacted no vendor. Brave Search was used for discovery only.

Sources: