Chinese hackers set a target - AI system breached entities in the US security establishment

Palo Alto researchers uncovered a cyberattack in which Chinese-speaking hackers used an AI penetration testing system to autonomously attack at least 19 organizations in the US, including security bodies and a teachers' union. The researchers assess it as intelligence-gathering activity linked to China.

Researchers at Palo Alto Networks' Unit 42 uncovered a cyberattack in which Chinese-speaking hackers used an artificial intelligence penetration testing system, named Cairn, to autonomously attack at least 19 organizations in the United States. The attacks occurred in August and September 2026 and included unauthorized access to ten of the organizations. Targets included entities in US security policy, semiconductor manufacturers, and an American teachers' union where over one million member records and approximately 31,000 contacts were exposed. In a security policy program's identity system, about 500 user records were exposed, including accounts with government and military email addresses. At a chip company, unauthorized admin accounts were created. Researchers assess with medium confidence that this is intelligence-gathering activity linked to China, under the designation CL-STA-1238. According to them, a single individual or a small team was behind the activity. The novelty was in the automation and scale, not in the complexity of the intrusion methods.