Open-Source AI Pentest Framework Used to Breach 10 Organizations, Including Semiconductor and Defense Firms

Chinese-speaking attackers utilized Cairn, an open-source AI penetration testing framework, to conduct 25 operations against at least 19 organizations in August and September 2026, successfully breaching 10 of them. Targets included seven organizations in the semiconductor and advanced-manufacturing supply chain, three in defense, and four in human rights. The attackers leveraged AI models like Zhipu GLM 5.2 and DeepSeek V4 Flash/Pro, often gaining access with minimal input.