AI-assisted attacks accessed systems or retrieved data at 10 organizations, according to a November 12 investigation by Palo Alto Networks’ Unit 42.
The security research team tracked 25 operations against at least 19 organizations during August and September 2026, including semiconductor companies, defense and policy organizations, and civil-society groups.
Unit 42 said the attackers used a customized version of Cairn, an open-source framework for AI-driven penetration testing, paired with Zhipu GLM and DeepSeek models.
The reported outcomes went beyond reconnaissance. The researchers reported unauthorized access to a semiconductor company’s production system and to more than one million member records at a U.S. teachers’ union. They also said the attackers modified a live standards-ballot document and obtained nonpublic data at an industry standards organization.
Unit 42 described a repeating human-AI work loop. Humans chose targets and goals and could supply intelligence. Cairn then planned an action, executed it and recorded findings, repeating until the operator judged the goal met, options were exhausted, or execution stopped. Individual operations lasted from 20 minutes to more than 50 hours, Unit 42 reported, with human steering still possible.
Unit 42 assessed that a single operator or small team likely ran the activity and argued that autonomous orchestration expanded the number of simultaneous attempts they could sustain. The arrangement, it said, let humans direct the campaign while agents sustained the intrusion work.
Unit 42 assessed that AI increased the scale and reach of the campaign, not its technical sophistication. The November 12 investigation adds quantified outcomes to earlier reporting on AI-assisted attacks.
Unit 42 concluded with moderate confidence that the activity it tracked represented China-nexus intelligence collection, based on language, tooling and target selection.
For defenders, the report’s practical warning is that familiar gaps can support prolonged, coordinated intrusion attempts. Unit 42 said identity hygiene, reducing exposed attack surfaces and software patching remain effective.
