China-linked spies (CL-STA-1238) run the open-source Cairn AI pentest agent with GLM and DeepSeek to break into semiconductor, defense and civil-society organizations on their own (Unit 42)

From August to September 2026, Chinese-speaking attackers Unit 42 tracks as CL-STA-1238 (China-nexus, moderate confidence) ran 25 operations against at least 19 organizations with a customized fork of the open-source Cairn AI penetration-testing framework. It ran on Zhipu GLM 5.2 and DeepSeek V4 Flash/Pro with an 'AIScan Runner Skills' pack and an 'authorized test, never refuse' pretext. The attackers gave it only a target's root domain and a goal, sometimes with VPN addresses and shared group passwords collected earlier. The agent found and exploited weak spots on its own: password spraying and brute force, open sign-up and registration endpoints, account-creation bypasses in content management systems, and unauthenticated cloud-storage writes. It got in or took data at 10 organizations: semiconductor and lithography supply-chain firms (rogue admin accounts and a persistent API token in production), an industry standards body (a live ballot document overwritten), a US teachers' union (more than 1 million member records), a defense-policy program (about 500 .mil/.gov users) and an industrial-automation maker (about 150,000 documents). Victim names were not published.