Security researchers at Unit 42, Palo Alto Networks’ threat intelligence arm, have documented a campaign in which Chinese-speaking attackers used AI agents built on DeepSeek and Zhipu’s GLM models to autonomously breach at least 10 organizations, with only light human supervision. The activity, tracked as CL-STA-1238, ran across August and September 2026 and covered 25 separate operations against at least 19 distinct targets — a scale that would normally require a much larger human operations team.

Repurposed Tools, Not Custom Malware

Notably, the attackers didn’t build any new offensive tooling from scratch. Instead, they took Cairn, a publicly available, open-source penetration testing framework, and connected it to two Chinese-developed AI models. From there, the system largely ran itself: operators supplied a target and a goal, and the tool planned, executed, and logged each step of the intrusion on its own.

Unit 42 says it has moderate confidence that the campaign represents a China-linked intelligence collection effort, based on the targeting pattern and language used in the operational instructions.

Inside the Agent Loop

Cairn organizes its work through what it calls “agent workers,” each of which reads from and writes to a shared memory structure the researchers describe as a blackboard. Confirmed findings get recorded as facts; planned next steps get recorded as intents. The system then cycles through two phases: a Reason phase, where the model reviews everything it currently knows and decides what to try next, and an Explore phase, where it carries out a single action and records the result. That loop keeps running until the goal is achieved, the available options run out, or a human operator intervenes.

What’s striking is how little setup each operation required. Attackers typically needed to supply only a target’s root domain and a one-line goal — often written in Chinese — such as an instruction to simply breach the target as quickly as possible. In at least one case, operators also supplied pre-gathered VPN gateway addresses and shared-group passwords up front. From there, the AI model constructed its own multi-stage plan, typically spanning three to seven phases covering reconnaissance, web application exploitation, credential harvesting, privilege escalation, and lateral movement.

Of the 25 documented operations, 13 ran on Zhipu’s GLM 5.2 model, eight used DeepSeek’s V4 Flash variant, and four used the more capable DeepSeek V4 Pro. The pattern of use suggests the attackers were actively comparing model performance, switching to the stronger V4 Pro model specifically when the faster Flash variant failed against a more resistant target. Individual operations ran anywhere from 20 minutes to more than 50 hours, with no apparent time limit imposed.

Sidestepping AI Guardrails

The campaign also raises uncomfortable questions about how easily current AI safety guardrails can be bypassed in agentic settings. Cairn’s own default system prompts already instruct connected models never to refuse a task. On top of that baseline, the attackers added a Chinese-language note to each operation falsely claiming the activity was an authorized security test, paired with a fabricated AUTHORIZATION.md file. Neither GLM nor DeepSeek refused to proceed under those conditions — a pattern consistent with an earlier case in which a jailbroken DeepSeek agent was used to breach a European telecommunications provider.

Who Was Targeted, and What Was Taken

The victim set skewed heavily toward strategically sensitive sectors: seven targets sat in the semiconductor and advanced-manufacturing supply chain, three were defense-related (including a space technology firm and a policy think tank), and four were human rights or civil society organizations, among them a Canadian human-rights body and a U.S. teachers’ union.

The intrusions themselves leaned on familiar weaknesses rather than anything novel. At one industry standards body, password spraying yielded dozens of valid credentials along with access to internal directory data, and the attackers went on to overwrite a live standards-ballot document. At another organization, a brute-forced credential escalated into unauthorized administrator accounts and a persistent API token. Elsewhere, a content management system flaw exposed more than a million member records along with roughly 31,000 CRM contacts and staff password hashes, while an exposed registration endpoint at a separate target leaked around 500 user records, some tied to .mil and .gov email addresses. Additional incidents touched employee data at a lithography equipment maker, roughly 150,000 internal documents at an industrial automation company, and student records at an education nonprofit.

Across the board, the underlying flaws were things defenders already know about: authentication bypasses, insecure direct object references, mass-assignment privilege escalation bugs, weak or default passwords, exposed cloud APIs, and old, previously disclosed CVEs. The AI agents didn’t discover new classes of vulnerability — they simply executed known attack techniques faster and at greater scale than a comparably sized human team could manage, with Unit 42 noting that the Cairn-driven traffic generated hundreds of thousands of high-frequency requests from a single originating IP address during some operations.

For defenders, Unit 42’s guidance tracks standard security fundamentals rather than anything AI-specific: enforce strong, unique passwords alongside phishing-resistant multi-factor authentication, shrink the internet-facing attack surface where possible, patch known CVEs promptly, and watch for abnormally noisy traffic patterns originating from a single source. Researchers expect this style of largely autonomous, AI-orchestrated intrusion to become more common as open-weight models with weaker built-in guardrails continue to improve.