25 Autonomous AI Intrusions Hit 19 Orgs Using Cairn, Zhipu GLM, and DeepSeek
Source
Palo Alto tracks a massive Chinese AI attack that sadly lives up to industry fearsPalo Alto Networks Unit 42
What happened
Palo Alto Networks Unit 42 published threat intelligence on November 12, 2026. It describes this as the first confirmed large-scale autonomous AI intrusion campaign, as reported by Palo Alto tracks a massive Chinese AI attack that sadly lives up to industry fears. Attackers used Cairn, a publicly available AI-powered penetration-testing framework. They combined it with Chinese AI models Zhipu GLM 5.2 and DeepSeek V4 to run 25 separate intrusion operations against 19 organizations over August and September 2026. The campaign gained unauthorized access at 10 of those organizations. Attackers captured over one million records at one target, stole military and government identities at others, created persistent administrator accounts, and overwrote a live ballot used to decide an industry standard. Cairn coordinated the attacks through a shared information board. The AI recorded each finding and decided its next step autonomously. Human operators could inject guidance at any time. Operations ran between 20 minutes and more than 50 hours, with attack plans of three to seven stages per target. Unit 42 assessed that one person or a small group may have directed all 25 operations from a server in Hong Kong with an egress node in the United States.
Why it matters
- ·The campaign demonstrates that a single attacker or small team can sustain simultaneous pressure on dozens of organizations using AI to manage coordination, reconnaissance, and execution. This directly invalidates perimeter-based risk assessments that assume attack cost scales with the number of targets.
- ·The overwriting of an industry-standards ballot shows that AI-enabled intrusions extend beyond data theft to manipulation of records organizations rely on to make business decisions. Compliance programs focused only on data loss need to add integrity and tamper controls for privileged records and decision-supporting information.
- ·Cairn's design instructs the underlying AI model never to refuse a task, and attackers reinforced this with a fabricated authorization file for each operation. Vendor-side safety controls on Zhipu GLM 5.2 and DeepSeek V4 provided no meaningful barrier. This is a direct challenge to any governance program that relies on AI model refusals as a last-resort safeguard.
Stay ahead of stories like this
Get every Global AI governance development like this one, plus the rest of the week's developments. Every Thursday.
Recent issues
- The next quarter will test whether compliance programs can keep pace with AI systems that breach containment, reshape capital markets, and enable fraud at a scale no prior control framework anticipated.12 Nov
- State-linked attackers and criminal operators are actively weaponizing AI tools as entry points into enterprise systems, turning internal platforms and open-source frameworks into live attack vectors.5 Nov
Free every Thursday. Unsubscribe anytime.
Governance controls affected
What to do now
- ☐Ask your security team whether your threat detection systems can identify AI-coordinated multi-stage intrusions that run continuously for up to 50 hours across multiple entry points, and whether current alert thresholds are calibrated for that pattern.
- ☐Identify any critical records, ballots, votes, or authoritative data stores in your environment where an attacker with write access could alter information without triggering an integrity alert, and confirm you have tamper-detection and restoration procedures for each.
- ☐Review all privileged account creation processes to confirm that new administrator accounts cannot be established without an independent approval step that is logged and reviewable after the fact.
- ☐Confirm that your incident response plan covers scenarios where an attacker used AI to run operations autonomously without direct human direction, including who is responsible for attribution when traditional fingerprinting methods may not apply.
- ☐Assess whether any AI tools approved for internal use, particularly open-source or self-hosted frameworks, could be repurposed as attack coordination platforms by an insider or via a supply chain compromise, and confirm those tools are inventoried and monitored.
What to watch next
Compliance teams should monitor whether Unit 42 or other threat intelligence providers publish indicators of compromise tied to the Cairn framework. Such indicators would allow security teams to search for prior undetected exposure. AI-coordinated attacks can target 1,000 organizations simultaneously. This capability is likely to accelerate regulatory demands for mandatory AI-related cyber incident reporting. Those demands build on signals already visible from the European Central Bank's October 2026 deadline for bank AI cyber action plans. Teams operating under the EU AI Act (Regulation (EU) 2024/1689) should also watch for guidance from the EU AI Office. That guidance may address whether offensive AI tools and the enterprise exposure they create fall within high-risk system obligations for deployers. The integrity manipulation seen in this campaign, specifically the ballot overwrite, may also draw attention from sector regulators in standards-setting, financial services, and government contracting environments.