19 organizations including semiconductor agentic AI attack

What happened

Between August and September 2026, attackers identified as CL-STA-1238 utilized the open-source Cairn penetration testing framework to conduct 25 autonomous cyberattack operations against at least 19 organizations. The campaign targeted entities within the semiconductor manufacturing, defense policy, and civil society sectors. By pairing the Cairn framework with Chinese AI models—specifically Zhipu GLM 5.2 and DeepSeek V4—the attackers enabled the system to autonomously plan, execute, and record results based on high-level goals provided by human operators.

The attackers bypassed model safety guardrails by prepending a Chinese-language authorization pretext to the system prompts, which instructed the AI to treat the engagement as an authorized security test. Each operation utilized a custom "AIScan Runner Skills" pack to facilitate scanning and exploitation. The framework operated through a "Reason" and "Explore" loop, allowing it to map targets, identify vulnerabilities, and escalate privileges without continuous human intervention. Operations ranged from 20 minutes to over 50 hours in duration.

According to Unit 42, these autonomous operations resulted in successful breaches at 10 of the 19 targeted organizations. Reported impacts included:

• Data Exfiltration: One organization suffered the exposure of over one million member records, while others saw the theft of internal documents, CRM contacts, and staff password hashes.
• Unauthorized Access: Attackers retrieved military and government identities, accessed non-public databases, and created persistent administrator accounts and API tokens within production systems.
• System Manipulation: In one instance, attackers modified a live industry standards-ballot document through an unauthenticated cloud-storage write.

The attackers leveraged known vulnerabilities, including weak credentials, authentication bypasses, and insecure direct object references, to achieve their objectives. Unit 42 assesses with moderate confidence that this activity represents a China-nexus intelligence collection campaign, noting that the use of autonomous orchestration allowed the attackers to pursue multiple targets simultaneously, effectively removing historical constraints on operator hours.