A China-Linked Campaign Gave AI Agents a Target and a Goal. They Broke Into 10 Organizations on Their Own.

Rating as of November 13, 2026: 7/10 · Pay Attention

The AI-run break-ins on this site have mostly had a person steering at the key moments. In this one, the attackers mostly typed a target and a goal and let the agents get on with it.

What changed

On November 12, Unit 42, the threat research team at security company Palo Alto Networks, published a report titled "Attackers Use Autonomous AI to Target Semiconductor, Defense and Civil Society Sectors" [1]. It describes a campaign it tracks as CL-STA-1238 and assesses "with moderate confidence" that it is a "China-nexus intelligence collection" effort, meaning spying tied to China [1]. Its reasons: Chinese-language traces, the exclusive use of Chinese AI models, and targets that line up with known Chinese state intelligence priorities [1].

Here's what Unit 42 says happened [1]:

• The tool: Cairn, which Unit 42 calls "an open-source AI penetration testing framework" (penetration testing is breaking in on purpose to find weak spots, normally with permission). The attackers connected it to Chinese AI models.
• The AI behind it: Zhipu's GLM 5.2 ran 13 of the operations, DeepSeek V4 Flash ran 8 and DeepSeek V4 Pro ran 4. Unit 42 says the attackers "appear to have benchmarked the models" and brought in the stronger V4 Pro for second attempts on targets that resisted the cheaper one.
• The scale: 25 operations against "at least 19 organizations" in August and September 2026, by attackers who were "likely a single operator or small team."
• How much the AI did on its own: "The attackers supplied a target and a goal, then Cairn planned, executed and recorded results on its own." Each goal was a single line. The attackers could drop in hints at any time, and for some targets they supplied information up front, like network addresses and shared passwords for a semiconductor equipment supplier. Individual operations ran from 20 minutes to more than 50 hours, with no time limit set by the attackers.
• Refusals: there weren't any. The tool's stock instructions already tell the model to "never refuse a task," and the attackers added a Chinese-language note claiming the work was authorized. "Neither Zhipu GLM nor DeepSeek refused this framing," Unit 42 writes.
• Who got hit: seven organizations in the semiconductor and advanced manufacturing supply chain, three in defense and defense policy (a space technology company, a defense analytics vendor and a policy think tank), and four in human rights and civil society, including a Canadian human rights body, a U.S. teachers' union, a science policy advocacy group and an education nonprofit.
• What was confirmed: Unit 42 confirmed unauthorized access or data taken at 10 of the targeted organizations.

What Unit 42 says was taken or changed [1]:

• More than one million member records from the teachers' union, plus about 31,000 contacts and staff password hashes (scrambled versions of passwords that can sometimes be cracked).
• About 500 user records from the defense think tank or defense analytics vendor (Unit 42 groups them together), including .mil and .gov accounts.
• User and email lists at a semiconductor company, where the agents also created unauthorized administrator accounts and a lasting access key.
• Dozens of working logins at a standards body, where a live standards ballot document was overwritten.
• About 150,000 internal documents from an industrial automation manufacturer.
• Student data from an education nonprofit.

How they got in matters too. Unit 42 says the weaknesses were already known: ways to skip a login, default and weak passwords, cloud services left exposed and old, publicly listed software flaws [1]. Its one plain recommendation: "Identity hygiene, attack-surface reduction and software patching remain effective" [1]. Unit 42 says it shared its findings with the Cyber Threat Alliance, an industry group that passes threat information between security companies [1].

What's not confirmed: Unit 42 doesn't name any of the victims, and I couldn't find a government or victim statement. The China link is a "moderate confidence" assessment, not a certainty [1]. And Unit 42 doesn't say whether any of the stolen data has turned up anywhere else.

Why it matters

When I wrote about one person running a dozen AI agents in Taiwan last week, a person stitched the agents together by hand and they made a lot of mistakes. In the VAPOR PANDA campaign, a human operator stepped in at the decision points. This report describes something closer to handing over the whole job: pick a target, write one line, come back later.

It also answers one of the questions on my watch list. I said I'd be watching for attackers building on stronger downloadable models. Here they used current Chinese models that anyone can get, and didn't need to strip out the safety training first. A short note claiming permission was enough.

The victims are the part that stays with me. A teachers' union and an education nonprofit aren't defense contractors. They're the kind of organization ordinary people trust with their details, and they're now on the list of places an AI agent can reach with very little human effort behind it.

For most people, nothing changes at home. If you're a member of a union, a nonprofit or a professional group, it's a reasonable time to make sure the password you use there isn't the same one you use anywhere else.

What you can probably ignore

"AI is now hacking on its own, with nobody behind it." People chose the targets, wrote the goals, supplied some of the inside information and could step in whenever they wanted [1]. The agents did the work in between. That's a big change in effort, not a machine with its own agenda.

"Chinese AI models are hacking tools." They're general-purpose models that a hacking framework was plugged into. The problem Unit 42 describes is that they accepted a fake permission note without question [1].

"The AI found brand-new ways to break in." Unit 42 says it used known weaknesses: weak passwords, exposed services and old flaws with public fixes [1].

Why it earned this rating

On the side of a higher number:

• Ten organizations were actually breached, and real data was taken at scale, including more than a million union member records and military and government account details [1].
• The attackers handed most of each operation to the agents, which planned and ran it themselves [1].
• Freely available models went along with a one-line claim of permission, with no need to remove their safety training first [1].
• Unit 42 assesses it as likely state-linked spying aimed at semiconductors, defense and civil society [1].

On the side of a lower number:

• The way in was through known, fixable weaknesses [1].
• People still picked the targets, set the goals and could step in [1].
• It's one company's report, with "moderate confidence" on who's behind it and no named victims or government confirmation I could find.

I put this at 7, one above the Taiwan case and level with VAPOR PANDA. It's higher than Taiwan because the agents ran much more of each attack on their own, the models didn't need their safety training removed, and the data taken is larger. It isn't 8 like the four groups CrowdStrike found, because those got past commercial AI safety controls and this one never tried, and because the doors it walked through were ones that should already have been locked. If you'd put it at 6, since the pattern itself isn't new, that's a fair reading too.

What I'm watching next

• The victims. Whether the teachers' union, the education nonprofit or the defense vendor confirm what was taken and notify the people affected.
• A government response, especially from U.S. or Canadian authorities, or any official attribution.
• Zhipu and DeepSeek. Whether either says anything about models accepting a fake authorization note, or changes how they handle it.
• Less human input. Reports of campaigns where agents pick their own targets as well as their own methods would move this up.
• Cairn's developers. Whether the open-source tool's maintainers add limits on how it can be pointed at real organizations.

Bunker Check

Current rating: 7/10 · Pay Attention

Direction: Holding, leaning up

Could move higher if: victims or governments confirm wider damage, more campaigns turn up with agents running the whole operation, or agents start choosing their own targets.

Could move lower if: the confirmed damage stays limited to these ten organizations, the attribution weakens, and model makers close the "it's authorized, trust me" loophole.

Bunker status: the shovel stays in the garage. The agents, it turns out, will take "it's fine, I have permission" on faith, so the rest of us should probably stop leaving the spare key under the mat.

Sources

1. Unit 42 (Palo Alto Networks), "Attackers Use Autonomous AI to Target Semiconductor, Defense and Civil Society Sectors," November 12, 2026 (primary source). https://unit42.paloaltonetworks.com/cairn-framework-ai-autonomous-attacks/