AI Campaign Reached 10 Organizations, With Unauthorized Access or Data Retrieval Confirmed

Unauthorized access or data retrieval was confirmed at 10 organizations targeted by a campaign that used a customized version of Cairn, an AI penetration-testing framework. Human operators directed 25 operations against at least 19 organizations in August and September 2026.

The findings do not map each operation to a specific organization, so the counts do not establish what share of the operations succeeded. The targets included the semiconductor sector, U.S. defense policy and civil society; the organizations were not named.

Operators selected targets and objectives, sometimes providing information gathered in advance. They could also guide Cairn during an operation, while the framework planned tasks, carried them out and recorded results. The 25 operations ranged in duration from 20 minutes to more than 50 hours.

Of the 25 operations, 13 used Zhipu GLM 5.2, eight used DeepSeek V4 Flash and four used DeepSeek V4 Pro. Cairn has also appeared in earlier TokenPost coverage.

At one semiconductor company, attackers created unauthorized administrator accounts and a persistent API token in a production system. At a U.S. teachers union, Cairn’s logs recorded access to more than 1 million member records, about 31,000 customer relationship management contacts and staff password hashes. Attackers also modified a live industry standards ballot. The findings do not establish that every accessed record was copied.

The intrusions used familiar weaknesses, including weak or default credentials, authentication bypasses and exposed cloud APIs. Unit 42 researchers wrote, “Autonomous AI raises the volume and coverage of exploitation, but not its complexity.” They recommended stronger identity controls, reducing exposed attack surfaces and patching software.

Unit 42 assessed with moderate confidence that the campaign represented China-nexus intelligence collection, based on Chinese-language tasking, the use of Chinese AI models and target selection. The researchers’ assessment is not a confirmed government attribution. They also assessed that one operator or a small team likely ran the campaign, with automated orchestration allowing attacks against more targets at once.