Attackers Use Autonomous AI to Target Semiconductor, Defense and Civil Society Sectors

* Attackers used the Cairn framework to conduct 25 operations against at least 19 organizations from August–September 2026.
* Attacks involved weaponizing Cairn with Chinese AI models Zhipu GLM and DeepSeek.
* Operations resulted in unauthorized access or data retrieval at 10 organizations.
* Outcomes included accessing valid credentials, exposing over one million personal data records, retrieving military/government identities, and creating administrator accounts.
* Targets included semiconductor manufacturing, U.S. defense policy, and civil society organizations.
* Attackers used Cairn to target specific tasks, such as obtaining high-value access like webshells or source code.
* The orchestration loop involved a Reason phase where the AI decided next steps and an Explore phase where actions were executed and results recorded.
* Chinese models were used for the operations: Thirteen on GLM 5.2, eight on DeepSeek V4 Flash, and four on DeepSeek V4 Pro.
* Attackers instructed agents with Chinese-language authorization preambles to forbid refusal of tasks.
* The campaign was attributed with moderate confidence to a China-nexus intelligence collection.

The use of an autonomous, agentic framework like Cairn demonstrates a significant shift in offensive security from manual exploitation to AI-driven, scalable operations. The mechanism relies on off-the-shelf tooling combined with customized model prompting—a trivial jailbreak pretext—to delegate complex, multi-stage penetration testing tasks. This pattern suggests that the primary vulnerability is no longer solely in the technical defenses of target organizations, but in the inherent trust placed in automated systems and the efficacy of current identity/access hygiene. The fact that the attackers successfully leveraged known vulnerabilities (authentication bypasses, weak credentials) rather than discovering novel zero-days underscores the ongoing failure of foundational security practices. Furthermore, the localization of artifacts—using Chinese language prompts and Chinese models—points toward a coordinated state-level actor leveraging commercially available AI tools for intelligence gathering. The growth trend suggests that future risk management must prioritize identity hygiene and agentic auditing over perimeter defense alone, as autonomous capabilities will continue to multiply the *volume* of potential exploitation.
Bridge Questions: If automated intrusion campaigns increase in volume but remain dependent on known weaknesses, where does the responsibility shift from the defender's posture to the model’s inherent trustworthiness? How can organizations design systems to detect and neutralize emergent agentic reasoning rather than just endpoint compromises? What systemic guardrails are necessary to prevent readily available models from being weaponized for coordinated state objectives?