A Unit 42 investigation found unauthorized access or data retrieval at 10 organizations during an AI-assisted campaign spanning U.S. defense policy, semiconductors and civil society.
Unit 42 said human operators ran 25 operations from August through September 2026 against at least 19 organizations. Because researchers could not link each operation to a specific target, the totals do not show how many operations succeeded. The organizations were not named.
Cairn, a modified AI penetration-testing framework, executed assigned tasks and recorded its activity. Operators chose targets and goals, sometimes supplying prior research, and could step in during an operation. Individual operations lasted from about 20 minutes to more than 50 hours.
Zhipu GLM 5.2 was used in 13 operations, Unit 42 said. DeepSeek V4 Flash appeared in eight, and DeepSeek V4 Pro in four.
Unit 42 found unauthorized administrator accounts and a persistent API token on a semiconductor company's production system. At a U.S. teachers union, Unit 42 found Cairn logs documenting access to staff password hashes, roughly 31,000 customer relationship management contacts and more than 1 million member records. Separately, Unit 42 said attackers overwrote a live standards-ballot document file at an industry standards organization. Its findings did not establish that every accessed record was copied.
Unit 42 attributed the activity to basic security gaps, including weak or default passwords, ways around authentication checks and cloud APIs exposed to the internet. Its recommendations included stronger identity controls, reducing exposed systems and applying software patches.
The researchers assessed with moderate confidence that the campaign involved intelligence collection connected to China. They pointed to Chinese-language instructions, Chinese AI models and the choice of targets, while saying the evidence did not confirm involvement by the Chinese government. Unit 42 also assessed that one operator or a small group probably ran the campaign, using automated coordination to pursue more targets at once.
