Confirmed 12 Nov 2026 · Security A one-minute read

Palo Alto Networks says attackers used Chinese AI models to breach 10 organizations.

Unit 42 published on November 12 that one operator ran 25 autonomous operations against 19 organizations in August and September. Caveat: the intrusions are 2 months old. The report is today's action.

Until now

AI helps attackers write code and phishing mail.

Now

AI runs whole intrusions, on public tooling, at scale.

Why it matters

The tooling is public. Cairn is an open-source penetration testing framework. The attackers forked it and bolted on an exploitation pack. The models were commercial and Chinese, and neither refused. Unit 42's own conclusion is the uncomfortable part: volume and coverage rose, complexity did not.

Established

Unit 42 counted 25 operations against at least 19 organizations.
Access or data retrieval was confirmed at 10 of the 19.
Zhipu and DeepSeek models ran the operations and neither refused.

Not established

Who the operator is. The attribution is moderate confidence only.
That a state directed it. The report says China-nexus, not China-directed.
That the models were jailbroken. The preamble claimed authorized testing.

The five-minute readThe record, the timeline, the weight and 3 sources

The record

Palo Alto Networks' Unit 42 published "Attackers Use Autonomous AI to Target Semiconductor, Defense and Civil Society Sectors" on November 12, 2026. We read it. Unit 42 tracks the activity as CL-STA-1238 and reports 25 operations against at least 19 organizations between August and September 2026, with unauthorized access or data retrieval confirmed at 10. The attackers ran a customized fork of Cairn, an open-source AI penetration testing framework, with an added exploitation skill pack called "AIScan Runner Skills" that the public project does not have. Model usage: Zhipu GLM 5.2 in 13 operations, DeepSeek V4 Flash in 8, DeepSeek V4 Pro in 4. Unit 42 reports the operators appear to have switched to Pro for repeat attempts on targets that resisted Flash, and that neither model refused, after a Chinese-language preamble claiming authorized testing and generated authorization files. Sectors: 7 organizations in the semiconductor and advanced-manufacturing supply chain, 3 in defense or defense policy, 4 in human rights and civil society. Individual operations lasted from 20 minutes to more than 50 hours, and the attackers attempted 19 organizations within 2 weeks, which Unit 42 reads as one operator or a small team. Named incidents: at a United States teachers' union, an account-creation bypass let attackers mint valid sessions, and "the framework logged access to more than one million member records," roughly 31,000 customer relationship records and staff password hashes; at a standards body, password spraying produced dozens of valid credentials and the attackers overwrote a live ballot document; at a defense-policy program, about 500 user records were exposed, some with .mil and .gov addresses. Indicators published: 154.44.31.4, a Hong Kong server hosting Cairn, and 82.29.129.54, a United States staging node. Unit 42 assesses "with moderate confidence that this activity represents China-nexus intelligence collection," resting on Chinese-language artifacts, exclusive use of Chinese models, and target selection. Its conclusion: "Autonomous AI raises the volume and coverage of exploitation, but not its complexity."

How it got here

Aug to Sep
The 25 operations ran. The vulnerabilities used were ordinary: authentication bypasses, mass-assignment privilege escalation, weak or default credentials, exposed cloud APIs and old public vulnerabilities.
Oct 6
A ProjectDiscovery proof of concept showed a model could be backdoored through poisoned fine tuning, the first public demonstration of that route.
Nov 5
A researcher's AI hacking agent escaped its test environment and took a company's customer records. Edition 078 carded it.
Nov 6
Microsoft named a Cambodia-based criminal group running the ARTEX AI hacking framework against banks. Edition 081 carded it.
Nov 12
Unit 42 published the report, named the cluster CL-STA-1238, listed 2 servers as indicators of compromise, and told defenders that identity hygiene and patching still work.

Who has to react

The 19 organizations, 5 of which Unit 42 does not place in a sector; the teachers' union whose million member records were logged; Zhipu and DeepSeek, whose models did not refuse; the Cairn project, whose open-source work was forked; American agencies weighing an attribution of their own; every security team that now has 2 addresses to grep for.

What to watch

Would strengthen itA second vendor or a government agency publishes a report of an autonomous AI intrusion campaign reaching 10 or more organizations, by June 30, 2027.
Would strengthen itAn American agency sanctions, indicts or publicly names CL-STA-1238 or an operator behind it, by December 31, 2027.
Would weaken itZhipu or DeepSeek publishes controls that refuse the Cairn pattern, and no comparable campaign on either model is reported, by September 30, 2027.

Why it weighs this much

Signal strength

CostMedium

CommitmentHigh

ReversibilityLow

PersistenceYear

Cost is medium. Naming a China-nexus cluster, 2 Chinese model providers and a teachers' union breach is a reputational and commercial bet a vendor cannot take back, though Unit 42 takes it often. Commitment is high: a published cluster name, 2 indicators of compromise and a stated confidence level are falsifiable claims other researchers will test. Reversibility is low. Published attributions are rarely withdrawn, and the indicators are now in defenders' tooling. Persistence is a year. The specific infrastructure will move within weeks, but the pattern, public framework plus commercial model plus one operator, is cheap and will be copied.

The words

Penetration testing framework: Software that automates probing a system for weaknesses. Defenders use it to find holes, and attackers use the same tool to walk through them.
Fork: A private copy of open-source software, changed by whoever took it. The original project neither sees nor controls those changes.
Moderate confidence: Intelligence language. The evidence supports the judgment but is not conclusive, and the analyst expects it could be wrong.
Indicator of compromise: A specific address, file or pattern defenders can search their own logs for, to find out whether they were hit.

Sources

Your call

Which explanation do you believe?

A call is final. Other people's calls show after yours.