Chinese-speaking hackers used AI tool to breach 10 groups

Chinese-speaking attackers used Cairn, an open-source AI penetration testing framework, to run 25 operations against at least 19 organizations in August and September 2026. They gained unauthorized access or retrieved data at 10 of them, according to research published Nov. 12 by Palo Alto Networks' ↘ 3.02% Unit 42. Two other reports this week describe attackers using AI against a U.S. retailer and against cloud accounts. Taken together, the reports show tools built for security testing being used in real intrusions.unit42.paloaltonetworks.com

An AI agent did the legwork

The attackers paired Cairn with the Chinese AI models Zhipu GLM and DeepSeek. They supplied a target and a goal, and the framework then planned, carried out and logged the attack on its own. Seven targets were in the semiconductor and advanced-manufacturing supply chain, three were in defense or defense policy, and four were human rights and civil society groups. Neither model refused the work. The attackers had added a Chinese-language preamble claiming every job was authorized security testing.helpnetsecurity.com+1

At a U.S. teachers' union, "the framework logged access to more than one million member records, roughly 31,000 CRM contacts and staff password hashes," the researchers said. At an industry standards body, the attackers overwrote a live standards-ballot document. Unit 42 assesses with moderate confidence that the campaign, tracked as CL-STA-1238, is China-nexus intelligence collection. It says one operator or a small team likely ran attempts against 19 organizations within two weeks.unit42.paloaltonetworks.com+1

AI revived a stalled break-in

In a separate report, Symantec Broadcom Inc. ↗ 5.31% described a September intrusion at a U.S. retailer. At first, the attackers typed commands by hand. The commands had typos, and security software killed every payload they staged. The next day, they switched to long, error-free PowerShell scripts, some with comments that read like a model's reasoning. About 10 minutes after first querying the victim's SolarWinds Orion software, they were running commands on a second server. Symantec said the timing points to a human relaying output to an AI tool rather than an autonomous agent. It added that this is one of dozens of AI-assisted attacks it has investigated since May.security.com

AntiFox turned on cloud accounts

Arctic Wolf Labs reported that attackers ran AntiFox, a Chinese-language agentic pentest platform forked from ARTEX, on Alibaba Cloud ↘ 6.71% servers. They used it to plant web shells on Microsoft ↗ 1.42% IIS servers and to probe Amazon Web Services Amazon.com, Inc. ↗ 1.42% environments with valid identities. In one intrusion, hundreds of API requests in about half an hour led to the retrieval of a production secret.securitybrief.asia+1

AWS said its "services were not compromised and operated as designed." It said the attackers used credentials taken from customers' compromised applications.securitybrief.asia

The flaws involved were familiar ones, such as weak credentials and old CVEs. Unit 42's view is that AI raised the volume of exploitation but not its complexity.helpnetsecurity.com