Palo Alto tracks a massive Chinese AI attack that sadly lives up to industry fears

Source: CSO Online · NOV 12, 2026

Palo Alto Networks Unit 42 is reporting today that it has tracked a massive China-based attack leveraging the open-source AI penetration testing framework Cairn to autonomously conduct 25 operations against at least 19 organizations. The attackers weaponized Cairn by pairing it with Chinese AI models Zhipu GLM and DeepSeek, Unit 42 said. The report said it monitored the attacks in August and September 2026 in which the Chinese-speaking attackers were able to successfully achieve unauthorized access at 10 of the targeted businesses, accessing dozens of valid credentials. It captured more than one million records at one business, grabbed military and government identities at others, created persistent admin accounts in multiple product systems. It even gained unauthenticated access to cloud storage and overwrote a live ballot for a vote on an industry standard. Through separate flaws, the attackers logged in as arbitrary customers and gained read, write and delete access to meeting, voti