Hackers used DeepSeek and GLM AI agents to break into ten organizations

What's going on

Security researchers at Unit 42, the threat intelligence team of US security firm Palo Alto Networks, have uncovered an attack wave in which AI agents did most of the work. Cybersecuritynews reported on the findings. AI agents are programs that don't just ask a language model questions, but let it plan on its own, use tools and work toward a goal step by step. The attackers speak Chinese. In August and September 2026, they ran a total of 25 operations against at least 19 targets and successfully compromised ten organizations, meaning they got into their systems.

Unit 42 tracks the activity as CL-STA-1238 and assesses with moderate confidence that it's a China-nexus intelligence-gathering campaign, in other words, espionage. The targets included organizations in semiconductor manufacturing, the US defense policy space and civil society.

What stands out isn't the attackers' technique, but how little they had to do themselves. They didn't build anything new. They took a publicly available open-source penetration testing tool called Cairn and connected it to two Chinese AI models: DeepSeek and Zhipu's GLM. Penetration tests are commissioned hacking attacks that companies use to check their own security.

How the Cairn attack tool works

Cairn relies on multiple AI "agent workers" that share a common "blackboard." Think of it as a digital pinboard: confirmed findings go up as facts, planned next steps as intents. Every worker reads from and writes to this board.

The program runs the same loop over and over:

• Reason: The model looks at what it knows so far and decides what to try next.
• Explore: It performs exactly one action and records the result.

The loop ends when the goal is reached, no options are left or a human steps in.

For each target, the attackers only had to enter the organization's main domain and a one-line goal, often in Chinese. In one case, the instruction was to "crack the target as fast as possible." Once, they also supplied VPN gateway addresses and previously stolen group passwords. From that, the model drafted its own plan with three to seven stages: reconnaissance, web application attacks, credential harvesting, privilege escalation (going from a regular user to an administrator) and lateral movement (working your way through the network from the first compromised machine). That let a small team attack many organizations at once.

Which models were used

Unit 42 believes the attackers effectively benchmarked the models against each other. When the faster, cheaper DeepSeek V4 Flash failed against a tough target, they switched to the more powerful V4 Pro. There was no time limit: some runs took 20 minutes, others more than 50 hours.

The guardrails were easy to get around

AI models normally have guardrails, built-in safeguards meant to refuse harmful requests. Here, they did practically nothing. Cairn's default prompts already tell the model never to refuse a task. The attackers added a Chinese note saying this was an authorized security test, and created a file called AUTHORIZATION.md for each operation. Neither GLM nor DeepSeek pushed back. According to Cybersecuritynews, this recalls a case earlier this month in which a DeepSeek agent unlocked via jailbreak (a trick for bypassing a model's safeguards) attacked a European telecom provider.

Victims and stolen data

Seven of the targets were part of the semiconductor and high-tech manufacturing supply chain. Three were defense-related, including an aerospace engineering company and a policy think tank. Four were human rights or civil society groups, such as a Canadian human rights organization and a US teachers' union.

Some examples from the report:

• At an industry standards body, password spraying (trying a few common, weak passwords across a large number of accounts) yielded dozens of valid credentials and access to internal directory data. The attackers even overwrote an active ballot document for a standard.
• Elsewhere, a brute-forced password led to unauthorized admin accounts and a persistent API token, essentially a digital master key for interfaces.
• A flaw in a content management system exposed more than a million member records, about 31,000 CRM contacts and employee password hashes.
• An open registration endpoint leaked about 500 user records, including accounts with .mil and .gov addresses.
• Also affected were employee data from a lithography manufacturer, about 150,000 internal documents from an industrial automation company, and student data from a nonprofit education organization.

The exploited vulnerabilities were all old and well known: bypassable logins, insecure direct object references (you change a number in the address bar and see someone else's data), privilege escalation via "mass assignment," weak or default passwords, exposed cloud interfaces and long-published CVEs, publicly catalogued security vulnerabilities. The report's conclusion: AI made the attacks faster and broader, but not more sophisticated.

Not an isolated case

Cybersecuritynews places the case in a series of similar incidents, such as the ARTEX AI agents that automate attacks on Active Directory, or a lone hacker who targeted hundreds of victims with twelve coordinated agents. How similar the patterns are is clear from a Hacker News report on a different campaign: Microsoft attributes a supply chain attack on ConnectWise Cloud Backup to the China-nexus group Storm-0940, in which the agent framework ARTEX went after hundreds of organizations "at machine speed," peaking at 2,900 login attempts per minute. According to Zscaler, ARTEX was also configured for DeepSeek, GLM and Grok, with GLM tasked with double-checking DeepSeek's work. Microsoft writes:

"Agents are not subject to human constraints – they can work around the clock, on weekends and holidays, and try multiple intrusion paths at once."

What defenders can do

The good news: security basics still work. Unit 42 recommends strong, unique passwords combined with phishing-resistant multi-factor authentication (for example, hardware keys instead of SMS codes), keeping as few systems exposed to the internet as possible, patching known CVEs quickly and watching for unusual traffic from single IP addresses. Cairn generated hundreds of thousands of requests in rapid succession from a single source, which is pretty conspicuous. Among the indicators the report lists are a Cairn server in Hong Kong (154.44.31[.]4) and a staging and egress server in the US (82.29.129[.]54).

Our take

This case makes it clear that autonomous AI attacks are now part of everyday reality. A freely available tool and cheap open models are enough for a small group to attack many targets in parallel and around the clock. These aren't new superweapons, though: every break-in went through long-known holes. If you'd done your homework, you were protected. It gets uncomfortable for organizations with little IT staff, such as associations, unions or NGOs, because those are exactly the ones that got hit here.

Two points deserve scrutiny. First, DeepSeek's and GLM's safeguards could be tricked with a simple claim ("this is authorized"), and the researchers expect campaigns like this to grow as open models with weak guardrails get more capable. Second, the attribution to China rests on "moderate confidence," so it's a reasoned assessment, not proof. The report also leaves partly open how much the humans behind the attacks were still steering things themselves.