Chinese attackers weaponize open-source Cairn framework with AI models for autonomous penetration testing

According to Palo Alto Networks Unit 42, a Chinese-origin attack leveraged the open-source Cairn AI penetration testing framework paired with Chinese models including Zhipu GLM and DeepSeek to autonomously conduct 25 intrusion operations. The incident represents early weaponization of open-source agent frameworks combined with language models for scaled attack automation.