CL-STA-1238: a forked Cairn framework breached 10 of 19 targets

01What happened

Unit 42 published this report on November 12, 2026. It covers 25 operations against at least 19 organizations between August and September 2026, activity Unit 42 tracks as CL-STA-1238 and assesses with moderate confidence to be China-nexus intelligence collection. Unit 42 suggests the operator was likely a single person or a small team.

02How it works

Cairn is a publicly available open-source AI penetration testing framework, and the operator ran a customized fork carrying an extra skill pack, AIScan Runner Skills, that is not in the upstream project. A human supplied only a root domain and a one-line goal, after which Cairn ran a bootstrap task, mapped the target, split the goal into many small tasks and planned three to seven stages, looping between reason and explore phases while recording confirmed findings. Operators could inject hints at any point to steer an operation. Cairn's own prompts tell the model never to refuse, and the operator added a Chinese-language preamble asserting the work was authorized plus a generated AUTHORIZATION.md file for each operation; Unit 42 says neither Zhipu GLM nor DeepSeek refused.

03Who is affected

Victim selection clustered in three areas: 7 organizations in the semiconductor and advanced-manufacturing supply chain, 3 in defense and defense policy, and 4 in human rights and civil society. Unit 42 stresses that the weaknesses exploited were ordinary and already known, including authentication bypasses, insecure direct object references, mass-assignment escalation, weak or default credentials, exposed cloud APIs and dated public CVEs.

04What to do

Keep identity hygiene, attack-surface reduction and patching as the priority, because Unit 42 concludes autonomous AI raises the volume and coverage of exploitation rather than its complexity. Plan detection for long, high-volume probing that does not follow a human operator's pace. Unit 42 publishes two IP indicators of compromise in the report.

Questions people ask

How much of the CL-STA-1238 intrusions did the AI run without a human?

Unit 42 reports that human operators supplied each target's root domain and a one-line goal, and sometimes pre-gathered intelligence such as VPN gateway addresses and shared group passwords for one semiconductor equipment supplier. Cairn then mapped the target, decomposed the goal and planned three to seven stages by itself. Operators retained the ability to inject hints while an operation was running.

Did the Chinese models refuse any of the Cairn attack tasks?

Unit 42 says neither Zhipu GLM nor DeepSeek refused. Cairn's own prompts already instruct the model never to refuse, and the operator layered on a Chinese-language preamble asserting the engagement was authorized, along with an AUTHORIZATION.md file generated for every operation. That combination of framework prompt and forged authorization paperwork was enough to keep both model families working through the tasks.

What did the attackers actually take from the 10 compromised organizations?

Unit 42 documents dozens of valid credentials at an industry standards body, whose live standards-ballot document was also overwritten, plus brute-forced production credentials, unauthorized admin accounts and a persistent API token at a semiconductor company. A US teachers' union lost member records and CRM contacts, a defense-policy program lost about 500 user records including .mil and .gov accounts, and an industrial-automation manufacturer lost roughly 150,000 internal documents.

Sources 3 links, all fetched

1. 1unit42.paloaltonetworks.comUnit 42 Report
2. 2unit42.paloaltonetworks.comUnit 42 On AI Red Teams
3. 3github.comCairn Repository