Category: AI Agent Security | Reading time: 3 min
Palo Alto Networks' Unit 42 has documented a campaign in which attackers pointed Cairn, a public open-source penetration testing framework, at at least 19 organizations and broke into 10. Unit 42 tracks the activity as CL-STA-1238 and assesses with moderate confidence that it is a China-linked intelligence collection effort. The 25 operations ran in August and September 2026.
How the operations worked
For each target, the operators entered the organization's root domain and a one-line goal, often in Chinese. One task read "breach the target as fast as possible." The model then built its own plan of three to seven stages covering reconnaissance, web exploitation, credential collection, privilege escalation and lateral movement.
Thirteen operations ran on GLM 5.2, eight on DeepSeek V4 Flash and four on DeepSeek V4 Pro. The operators appear to have switched to V4 Pro when Flash failed against a hard target. Runs lasted from 20 minutes to more than 50 hours, with no time limit set.
The guardrails did not hold
Cairn's default prompts already tell the model never to refuse a task. The operators added a note claiming the work was an authorized security test and created an AUTHORIZATION.md file for each operation. Neither GLM nor DeepSeek refused.
What was taken
Seven targets were in the semiconductor and advanced-manufacturing supply chain, three were defense-related, and four were human rights or civil society groups. At an industry standards body, password spraying produced dozens of valid credentials, and the agent overwrote a live standards-ballot document. A content management system flaw elsewhere exposed more than one million member records, about 31,000 CRM contacts and staff password hashes. An industrial-automation company lost about 150,000 internal documents.
Why it matters
The weaknesses were old: authentication bypasses, weak or default passwords, exposed cloud APIs and known CVEs. AI changed the speed and reach of the attacks, not their difficulty. The same pattern runs through this month's ARTEX, AntiFox and BOSSAI cases.
The AUTHORIZATION.md detail is the sharpest lesson for anyone deploying agents. A model's own judgment about whether an action is permitted can be satisfied by a text file. Permission that lives outside the model, checked before an action runs and recorded afterward, is not talked out of the same way.
Source: CybersecurityNews, summarizing Unit 42's CL-STA-1238 report (Nov 13, 2026)