Attackers breached 10 organizations with an open-source AI pentest framework

open-source has confirmed a data breach exposing login credentials.

Chinese-speaking attackers used Cairn, an open-source AI penetration testing framework, to run 25 operations against at least 19 organizations in August and September 2026.

Palo Alto Networks’ Unit 42 found that the attackers gained unauthorized access or pulled data at 10 of them, often after typing little more than a domain name and a one-line goal.

The model reviews what it has confirmed so far, picks one next action and runs it, and the framework logs the result as a new fact.

The attackers added a Chinese-language preamble claiming every job was authorized security testing, and each operation generated an AUTHORIZATION.md file declaring the work client-approved.

At a semiconductor company, a brute-forced production credential led to new administrator accounts and a persistent API token.

Anyone whose data open-source held is potentially affected, specifically account holders whose records were exposed.

They believe one operator or a small team ran all of it, with simultaneous intrusion attempts against 19 organizations inside two weeks.

The attackers ran a customized fork from a Hong Kong server, with an exploitation skill pack called AIScan Runner Skills that the public Cairn project lacks.

Stolen credentials travel -- attackers routinely test them against unrelated services, which is why the exposure doesn't stop at the breached system's own doors.

This is the uncomfortable part of a vendor breach: the victim organization can do everything right internally and still be exposed through a partner it had to trust.

An open registration endpoint tied to a defense-policy program exposed about 500 user records, some with .mil and .gov addresses.

The exposure here is through a third-party vendor relationship, not a direct intrusion into the victim's own systems.

At an industry standards body, password spraying produced dozens of valid credentials.

The attackers also overwrote a live standards-ballot document through a cloud storage location that accepted writes without authentication, and other flaws let them log in as arbitrary customers with control over meeting and voting functions.

Unit 42’s view is that autonomous AI raised the volume and coverage of exploitation but not its complexity, so identity hygiene, a smaller attack surface and patching still work.

If you have any relationship with open-source, watch for phishing attempts that reference this breach specifically -- stolen data often gets reused this way.

Any reused password from this account is worth changing immediately, especially on other services where the same password might still be active.

If you run a similar vendor relationship yourself, this is a reasonable prompt to review what data that vendor actually holds and why.

Any unsolicited message referencing this breach is worth treating with suspicion, since attackers commonly impersonate the breached company afterward.