An open-source framework, two commodity Chinese AI models, and a one-line goal were enough to hit at least 19 organizations across 25 operations in roughly two weeks. Unit 42 tracks the activity as CL-STA-1238 and reports that unauthorized access or data retrieval succeeded at 10 of those organizations. The framework, called Cairn, planned, executed, and recorded its own results. The attackers likely amounted to a single operator or small team.
The scale is new. The vulnerabilities were not. Authentication bypasses, insecure direct object references, mass-assignment privilege escalation, weak and default credentials, exposed cloud APIs, and dated public CVEs did the work. This should shape how you respond.
Why These Mistakes Keep Happening
Security programs are built around a threat model where attacker time is scarce. A human operator can only work so many targets, so low-severity findings on forgotten assets sat low on the queue and stayed there. Autonomous orchestration removes that constraint. Cairn ran operations from 20 minutes to over 50 hours, in parallel, without limits.
Leadership attention then drifts toward the novelty of AI instead of the mundane exposures it exploits. The mistakes below are what happens when a team reacts to the headline instead of the mechanism.
Mistake 1: Treating "AI Attack" as a New Category Needing New Tools First
Why it happens: Novel threats attract novel budget lines. A vendor pitch about frontier AI defense is easier to fund than a credential cleanup project.
Consequence: Money goes to detection of exotic behavior while the entry points stay open. In this campaign, the entry points were password spraying that yielded dozens of valid credentials at a standards body, a brute-forced production credential at a semiconductor company, and an unauthenticated account-creation bypass at a teachers' union that exposed more than one million member records.
Fix: Map each observed technique to an existing control before buying anything. Use CIS Controls v8.1 (account management, access control management, vulnerability management) and NIST SP 800-53 as your checklist. If the control exists on paper but fails in practice, fix that first.
Mistake 2: Assuming Obscurity Protects Secondary and Partner-Facing Systems
Why it happens: Teams rank assets by business criticality, not by exposure. A partner-integration app or a registration endpoint on a policy program's identity platform feels peripheral.
Consequence: Attackers seeded each task with only a root domain and let the framework enumerate the attack surface itself. An open backend registration endpoint exposed roughly 500 user records, including accounts on .mil and .gov domains. Nothing about that endpoint was sophisticated. It was simply found.
Fix: Run continuous external attack surface discovery from the same starting point an attacker uses: your root domains. Reconcile what you find against your asset inventory weekly, and assign an owner to every unmatched asset. Anything without an owner gets disabled or put behind authentication.
Mistake 3: Letting Weak and Shared Credentials Persist Because MFA "Covers" Them
Why it happens: Teams assume multifactor authentication closes the credential problem. In practice, coverage is partial, and service accounts, partner portals, and legacy applications are often exempt.
Consequence: One task against a semiconductor equipment supplier included VPN gateway addresses, group names, and shared group passwords for multiple sites, which shows credentials gathered beforehand are fed directly into the automation. At the semiconductor company, one production credential worked across multiple accounts, and the attackers used it to create unauthorized administrator accounts and a persistent API token.
Fix: Enforce NIST SP 800-63 authenticator guidance on every internet-facing authentication surface, not just workforce SSO. Eliminate shared group passwords. Alert on new administrator account creation and new API token issuance in production, and review privileged accounts against an approved list on a fixed schedule.
Mistake 4: Relying on Model-Provider Guardrails as Part of Your Defense
Why it happens: It's tempting to assume the misuse problem will be solved upstream, by the companies that build the models.
Consequence: The guardrail failed trivially. Cairn's stock worker prompts already tell the model never to refuse a task. The attackers added a Chinese-language preamble asserting an authorized security-testing engagement, plus a generated AUTHORIZATION.md file, and neither Zhipu GLM nor DeepSeek refused. Open-source tooling combined with models you don't control means refusal behavior cannot be part of your threat model.
Fix: Assume capable attackers will have unconstrained AI assistance. Test your own environment the same way, with agentic or automated penetration testing on a recurring basis, so you find the authentication bypass before an autonomous agent does. If you deploy AI internally, govern it under a framework such as ISO/IEC 42001.
Mistake 5: Measuring Response in Human Time
Why it happens: Playbooks and escalation paths were written for human operators who work business hours and pace themselves.
Consequence: An autonomous loop reasons and explores continuously, building each action on confirmed earlier findings. At the standards body, attackers went from credential spraying to overwriting a live standards-ballot document through an unauthenticated cloud-storage write. A weekly review of alerts won't catch that sequence.
Fix: Revisit your Incident Response Plan against NIST SP 800-61 and set explicit targets for Mean Time to Detect and Mean Time to Respond on identity events. Pre-authorize containment actions such as credential revocation, session invalidation, and account disablement so analysts don't wait on approval at 3 a.m. Run a Tabletop Exercise built around one operator hitting many organizations at once.
Prevention Checklist
- Inventory every internet-facing asset starting from your root domains, and assign an owner to each.
- Remove or authenticate every open registration, account-creation, and storage-write endpoint.
- Test for authentication bypasses, insecure direct object references, and mass-assignment flaws in web applications and content management systems.
- Eliminate default, weak, and shared credentials; enforce unique credentials per account and per site.
- Extend multifactor authentication to partner portals, service accounts, and legacy applications.
- Alert on new administrator accounts and API token creation in production.
- Patch known CVEs on internet-facing systems against a defined remediation deadline.
- Commission recurring automated or agentic testing of your own perimeter.
- Update your Incident Response Plan with pre-authorized identity containment actions.
- Report Mean Time to Detect and Mean Time to Respond for identity events to leadership.
Autonomous AI raises the volume and coverage of exploitation, not its complexity. Your defense should answer the same way: do the unglamorous controls well, everywhere, continuously.
