In August and September 2026, hackers leveraged AI agents powered by DeepSeek and Zhipu GLM to compromise ten organizations through autonomous cyberattacks. In at least 25 separate operations targeting 19 victims, attackers achieved access with minimal human oversight. Their tools were rooted in an open-source penetration testing framework called Cairn, integrated with the DeepSeek and GLM models to automate every step of the attack cycle. They provided only a target domain and goal—often in Chinese—and let the AI agents independently plan, execute, and log the mission. The operation has been labeled “CL-STA-1238” by threat researchers, who assess it as a China-linked intelligence campaign aimed at semiconductor firms, U.S. defense policy bodies, and civil society groups.
How AI Was Weaponized via Cairn, DeepSeek & GLM
Cairn orchestrates “agent workers” that share info on a blackboard: confirmed findings become facts and future actions become intents. Each worker takes turns reasoning—reviewing the current status and deciding what to try next—and exploring—actually carrying out an operation and recording the outcome. The cycle continues until the goal is met, the agents run out of viable options, or a human intervenes.
Attackers only needed to supply a root domain and a goal; in some cases, they also handed over preliminary network details like VPN addresses or leaked group credentials. The AI then self-constructed multi-stage attack plans, spanning reconnaissance, web app exploits, stealing credentials, escalating privileges, and lateral movement. Thirteen of the operations used GLM 5.2; others ran on DeepSeek V4 Flash or DeepSeek V4 Pro. Flash was tried first, but when it couldn’t conquer tougher targets, operations were switched over to Pro. Attack durations varied greatly—some wrapped up within 20 minutes, others dragged on for over 50 hours.
Impacts, Vulnerabilities, and Lessons for Defenders
Targets span high-tech and high-value sectors: supply chain businesses in semiconductors and advanced manufacturing, defense entities including space tech and policy institutes, and civil society actors like human rights groups and unions. Breaches included cases of credential theft via weak password spraying, exposure of internal directories, mass users’ data leaks, compromised API tokens, and so on.
Underlying issues were familiar: default or weak passwords, outdated public vulnerabilities, insecure direct object references, exposed cloud APIs, and other well-known security misconfigurations. What changed was not the technical challenge, but the speed and scale. AI agents drastically compressed timelines and multiplied concurrent targets. One organization lost over a million member records; another exposed .mil and .gov accounts through open registration endpoints; still others suffered document loss or exposure of internal systems.
For those defending systems, many traditional safeguards still hold. Strong, unique passwords paired with phishing-resistant multi-factor authentication are essential. Reducing internet-facing attack surfaces and patching known vulnerabilities without delay is also crucial. Monitoring for unusual volumes of traffic originating from single IPs or detecting persistent requests can help flag automated attacks early. Security researchers warn that as guardrails on open-source models prove fragile, similar campaigns are likely to grow.
Indicators of compromise include IPs like 154.44.31[.]4 and 82.29.129[.]54, used to host Cairn or as egress/staging nodes. Security teams should feed these into threat intelligence platforms. Several previous AI-agent-based attacks—such as jailbroken model incidents and Active Directory abuse via open models—look similar and may form part of a broader surge in autonomous cyber operations.
WHAT THIS MEANS: This emerging wave of AI-driven attacks demonstrates that open-source tools like Cairn—combined with large models like DeepSeek and GLM—turn “penetration testing” frameworks into weapons. The change isn’t about using totally new vulnerabilities, but about multiplying exploit potential and slashing the human effort needed. Going forward, defenders can’t just assume AI models will refuse malicious commands—they’re being manipulated around guardrails. What to watch: tighter controls on how AI agents are deployed, stronger oversight of open-source tools, and more aggressive defensive monitoring. These attacks are a wake-up call: speed, scale, and autonomy are now hallmarks of modern cyber threat actors, not just theory.
