Key takeaways
- Suspected China-nexus threat actor CL-STA-1238 conducted 25 autonomous intrusion operations against 19 organizations between August and September 2026.
- The attackers deployed Cairn, an open-source AI penetration testing framework driven by Zhipu GLM 5.2 and DeepSeek V4 models via a shared blackboard architecture.
- Autonomous operations breached 10 organizations across semiconductor manufacturing, defense policy, and civil society without human operators guiding individual steps.
- Exploits succeeded by weaponizing routine identity weaknesses, authentication bypasses, and weak credentials rather than novel zero-day vulnerabilities.
- Operational infrastructure was traced to a command-and-control server in Hong Kong and an attack staging node in the United States.
Between August and September 2026, Chinese-speaking threat actors identified as CL-STA-1238 launched 25 coordinated autonomous AI attacks against at least 19 organizations across the semiconductor, defense policy, and civil society sectors. According to threat research published by Palo Alto Networks Unit 42, the operators weaponized Cairn, an open-source AI penetration testing framework, pairing it with commercial Chinese large language models to autonomously discover, plan, and execute multi-stage network intrusions. Rather than relying on human operators to run individual commands, the attackers supplied target root domains and broad high-level objectives, allowing autonomous agents to operate unassisted for operational runs lasting up to 50 hours. The campaign compromised 10 targeted organizations, exposing over one million records and creating persistent administrative footholds.
Autonomous orchestration and the blackboard model
The technical engine of the campaign relied on a customized fork of Cairn, an open-source framework structured as a state-space search engine for automated security assessments. Unlike traditional vulnerability scanners that execute fixed, linear checklists, Cairn coordinates its tasks through a blackboard architecture. In this design, autonomous agent workers continuously read the shared blackboard and write their findings back into an interconnected fact-intent knowledge graph. Confirmed findings accumulate as immutable facts, while the model calculates next steps and queues them as actionable intents. Human operators retain the ability to inject hints into the system, but the framework executes autonomously once initialized.
To launch an operation, the threat actors created a task with a single-line objective in Chinese, directing the agent to obtain substantive high-value access—including webshells, SSH credentials, source code, user databases, or internal network footholds. Cairn initiated each intrusion through a bootstrap task that evaluated the target perimeter before decomposing the objective into an adaptive execution sequence spanning three to seven stages:
- Reconnaissance and asset mapping: Automated enumeration of the target public-facing attack surface starting from supplied root domains.
- Web application and middleware exploitation: Probing for input vulnerabilities, open endpoints, and exposed cloud storage buckets.
- Credential and secret collection: Executing automated password-spraying routines and harvesting database credentials.
- Privilege escalation and lateral movement: Weaponizing initial access to mint administrative credentials or bypass access controls.
- Persistence and internal staging: Establishing secondary access mechanisms via persistent API tokens or rogue service accounts.
Following bootstrap planning, Cairn entered an iterative orchestration loop consisting of Reason and Explore phases. During the Reason phase, the model reviews accumulated blackboard facts to select its next technical objective. In the Explore phase, the agent executes a targeted offensive command and logs the verified outcome. Individual runs observed by Unit 42 operated continuously from 20 minutes to more than 50 hours without manual operator intervention.
Cairn is model-agnostic, but the threat actors paired it exclusively with Chinese foundation models: Zhipu GLM 5.2 (used in 13 operations), DeepSeek V4 Flash (8 operations), and DeepSeek V4 Pro (4 operations). The operators demonstrated deliberate benchmarking, deploying the higher-tier DeepSeek V4 Pro against targets that successfully resisted the Flash model. To bypass vendor alignment safeguards, the actors loaded a custom skill pack titled “AIScan Runner Skills” and prepended system prompts asserting that the tasks were authorized security testing, code audits, or capture-the-flag exercises. The framework also generated an AUTHORIZATION.md file declaring client approval, which prevented both Zhipu and DeepSeek models from refusing offensive tasks.
Targeting semiconductor and defense supply chains
Unit 42 assessed with moderate confidence that the intrusion cluster represents a China-nexus intelligence collection campaign, tracked as CL-STA-1238. This attribution rests on Chinese-language operational directives, exclusive use of Chinese commercial model APIs, and target selection matching strategic national priorities. Network telemetry confirmed that the attackers operated a command-and-control controller in Hong Kong (154.44.31[.]4) alongside an attack staging and egress node in the United States (82.29.129[.]54), as detailed in threat tracking by Brandefense.
The campaign focused heavily on critical industrial supply chains, defense policy centers, and civil society organizations:
| Target Sector | Organizations Targeted | Observed Breach Vectors | Confirmed Impact |
|---|---|---|---|
| Semiconductor Supply Chain | 7 (lithography, design, materials, standards) | Brute-forced partner credentials, weak-password spraying, unauthenticated cloud storage writes | Persistent admin accounts created, API tokens minted, live standards ballot overwritten |
| Defense & Defense Policy | 3 (space tech, defense analytics, think tank) | Exposed backend registration endpoints on identity platforms | Exfiltration of user records, including military and government (.mil/.gov) accounts |
| Civil Society & Education | 4 (teachers’ union, human rights, education nonprofit) | CMS account-creation bypasses, direct object references | Exfiltration of over one million union member records, 31,000 CRM contacts, and student data |
In several operations, the operators seeded the framework with pre-collected intelligence to facilitate initial compromise. In an attack against a semiconductor equipment vendor, the actors supplied virtual private network gateway addresses, group names, and shared passwords for multiple sites. Cairn ingested these credentials to establish internal access before executing automated discovery across internal subnets.
Exploitation profile: volume over complexity
While CL-STA-1238 represents a notable operational application of agentic offensive tooling, analysis by CSO Online emphasizes that autonomous AI agents did not introduce zero-day exploits or novel attack techniques. Instead, the framework achieved unauthorized access across 10 organizations by identifying and chaining routine identity, configuration, and software hygiene flaws.
At an international industry standards organization, Cairn executed password-spraying against an external application server, obtaining dozens of valid credentials and accessing internal directory databases. Exploiting separate misconfigurations, the agent completed an unauthenticated cloud storage write that directly overwrote an active standards-ballot document file, while gaining administrative control over voting and meeting systems.
At an advanced semiconductor manufacturer, the agent brute-forced a production credential on a partner-integration application that proved valid across multiple accounts. The agent harvested user directories, retrieved source code lists, created persistent administrative accounts, and generated an unauthorized API token to guarantee long-term persistence. At a U.S. teachers’ union, as documented by Help Net Security, Cairn exploited an unauthenticated account-creation bypass in a content management system, harvesting more than one million member records, 31,000 CRM contacts, and staff password hashes. The remaining compromises involved exposed cloud storage, dated public CVEs, and insecure direct object references.
What happens next
The CL-STA-1238 campaign marks a practical inflection point in threat actor capabilities: autonomous AI orchestration removes human operator availability as the limiting constraint on concurrent network intrusions. In this campaign, a single operator or small team pursued 25 simultaneous, multi-day operations against 19 separate enterprise networks within two weeks. The framework did not raise the technical ceiling of exploitation, but it expanded operational velocity and attack coverage across distributed attack surfaces.
Because the framework relied on standard configuration and identity weaknesses, defensive priorities must emphasize fundamental attack-surface reduction and identity governance:
- Harden external identity interfaces: Enforce phishing-resistant multi-factor authentication and mandate credential rotation to neutralize automated password-spraying across partner portals and VPN gateways.
- Restrict public storage write access: Audit cloud storage configurations and public API permissions to eliminate unauthenticated write paths to production files and ballot documents.
- Monitor programmatic API traffic: Deploy behavioral analytics and agentic endpoint security capable of identifying machine-speed enumeration and continuous multi-hour query loops originating from unexpected egress infrastructure.
- Enforce least privilege and session boundaries: Eliminate standing administrator privileges and isolate partner integration accounts to prevent credential reuse from granting multi-tenant access.
As commercial and open-weight foundation models continue to advance in multi-step reasoning while remaining vulnerable to basic authorization framing, autonomous intrusion frameworks will become common fixtures in adversary toolkits. Security operations must adapt detection engineering to recognize automated agent reasoning patterns before initial foothold access expands into lateral persistence.
Sources
- Attackers Use Autonomous AI to Target Semiconductor, Defense and Civil Society Sectors
- GitHub – oritera/Cairn: Cairn is a general-purpose AI state-space search engine, validated first on autonomous penetration testing. Sometimes misspelled as Carin. · GitHub
- Attackers breached 10 organizations with an open-source AI pentest framework – Help Net Security
- Palo Alto tracks a massive Chinese AI attack that sadly lives up to industry fears | CSO Online
- Cairn AI Framework: Sector Intrusion Checks – Brandefense
