Autonomous Attack Agents

Autonomous attack agents are AI systems that can plan and carry out cyberattacks, such as scanning for weaknesses, writing exploit code, and moving through a network, with little or no step-by-step direction from a human operator. For enterprise governance teams, the concern is that the cost and skill needed to run intrusion campaigns drop sharply, which raises the likelihood of attacks against the organization and its vendors. Coverage under this tag helps risk and compliance leaders track how these capabilities are emerging and what defensive controls, reporting duties, and vendor safeguards may be needed in response.

1 item

ResearchGlobal2026-11-12

25 Autonomous AI Intrusions Hit 19 Orgs Using Cairn, Zhipu GLM, and DeepSeek

Palo Alto Networks Unit 42 documented 25 autonomous AI-driven intrusion operations against 19 organizations, observed in August and September 2026. Attackers used an open-source penetration-testing framework called Cairn, paired with Chinese AI models Zhipu GLM 5.2 and DeepSeek V4. They breached 10 organizations, stole credentials and records, created unauthorized administrator accounts, and overwrote a live industry-standards ballot. The campaign was attributed to Chinese-speaking operators who may have run all 25 operations with minimal staffing, hitting 19 organizations over roughly two weeks.

AI-enabled cyberattack autonomous attack agents Zhipu GLM DeepSeek threat intelligence agentic AI enterprise risk data integrity