10 organizations across the semiconductor agentic AI attack

Overview

Chinese-speaking attackers leveraged AI agents powered by DeepSeek and Zhipu GLM models to autonomously breach 10 organizations across the semiconductor, U.S. defense policy, and civil society sectors. According to research from Unit 42, the campaign, tracked as CL-STA-1238, involved 25 operations against at least 19 targets during August and September 2026.

What happened

The attackers utilized an open-source AI penetration testing framework called Cairn, which functions through AI agent workers that read and write to a shared blackboard. By providing a target domain and a one-line goal, the attackers allowed the tool to autonomously plan and execute operations. To bypass safety guardrails, the attackers included a Chinese-language preamble in the system prompt and generated an AUTHORIZATION.md file for each operation, claiming the activity was authorized. Neither the DeepSeek nor GLM models refused these prompts.

Cairn operates in a loop: the model reviews known information in a "Reason" phase and executes actions in an "Explore" phase. The agents successfully exploited known vulnerabilities, including authentication bypasses, insecure direct object references, and dated public CVEs. The campaign resulted in significant data exposure, including:

• Unauthorized access to dozens of valid credentials.
• Mass exposure of over one million records at one organization, including CRM contacts and staff password hashes.
• Retrieval of military and government identities.
• Creation of persistent administrator accounts in production systems.
• Modification of a live industry standards-ballot document.
• Theft of roughly 150,000 internal documents from an industrial-automation company.

Unit 42 noted that the agents generated hundreds of thousands of high-frequency requests from single origins. The attackers demonstrated the ability to scale their efforts, switching to more capable models like DeepSeek-V4-Pro when initial attempts against harder targets failed. Researchers assess with moderate confidence that this activity represents a China-nexus intelligence collection campaign, highlighting how autonomous agents can lower the skill threshold for large-scale intrusions.