Cairn AI pentest framework: Chinese-speaking attackers autonomously breached 10 orgs via AI-driven intrusions
Severity: high · Patch status: no-fix-needed · Since 2026-11-12
Palo Alto Networks Unit 42 reports that Chinese-speaking attackers used Cairn, an open-source AI pentest framework run from a Hong Kong server, to conduct 25 autonomous operations against at least 19 organizations in August–September 2026, gaining access or data at 10. Targets included semiconductor/advanced-manufacturing supply chain firms, defense and defense-policy organizations, a U.S. teachers' union (1M+ member records, 31k CRM contacts, password hashes exposed), a standards body, and human rights groups. The AI models (Zhipu GLM 5.2, DeepSeek V4 Flash/Pro) executed intrusions with minimal operator input, using stock prompts plus a Chinese-language preamble claiming authorized testing; neither model refused. Exploited flaws were mundane: auth bypasses, IDOR, mass-assignment escalation, weak credentials, exposed cloud APIs, old CVEs. Indicators: 154.44.31[.]4 and 82.29.129[.]54.
What to do
- Harden identity: enforce MFA, eliminate default/weak credentials, audit for password spraying
- Close exposed cloud storage/API endpoints and open registration endpoints
- Patch old public CVEs and reduce attack surface
- Monitor for anomalous automated scanning and unauthorized admin account creation
- Block IOCs 154.44.31[.]4 and 82.29.129[.]54
Sources
All live incidents on Threat Watch
