Attackers Use Autonomous AI to Target Semiconductor, Defense and Civil Society Sectors

Chinese-nexus attackers leveraged an open-source AI penetration testing framework (Cairn) combined with large language models to autonomously conduct 25 intrusion operations across 19 organizations in just two months, with roughly half resulting in confirmed unauthorized access or data theft. The use of autonomous AI dramatically lowers the cost and expertise barrier for sustained, multi-target intelligence collection campaigns. Credential theft and persistent administrator account creation indicate that privileged access management and monitoring controls were insufficient to detect or stop the intrusions in time. The exposure of over one million personal records underscores the downstream data protection consequences when access controls fail. This incident signals a new threat paradigm where AI-accelerated attack cycles will outpace traditional human-speed detection and response.