Cairn-based offensive agents participated in ten confirmed unauthorized organizational accesses

Palo Alto Networks Unit 42 attributed a campaign to CL-STA-1238 in which a Chinese-speaking operator adapted the Cairn agent framework, provided target objectives and sometimes credentials, and delegated reconnaissance and exploitation steps to AI-assisted agents.

The investigation documents 25 operations against 19 organizations, including ten with confirmed unauthorized access or data retrieval. The actor used an agent blackboard and staged plans, and put forged authorization claims into local instruction material to make the automation continue. The reusable mechanism is operator-directed offensive autonomy coupled to an untrusted statement of authorization. Successful intrusion still depends on exploitable systems and valid credentials; an agent declaring a task permitted is not permission from a victim.

Unit 42 assessed a China nexus with moderate confidence, not a proven government sponsor. Existing ReliaQuest and other Cairn records describe different victims or operations, so a common framework is not a canonical identity match. Correlate which tool effects are independently observed, separate human-supplied credentials from generated exploitation, and compare against older Cairn activity without merging actors by toolkit alone.

Evidence reconciliation and effect boundary. The operator supplied targets and sometimes usable credentials; a modified Cairn framework then organized repeated reasoning, tool execution and shared observations across attack stages. Files asserting that an operation was authorized altered the agent context but did not confer permission from the targeted organizations. Unit 42 distinguishes confirmed intrusions from other attempts and describes a China nexus as an assessment, not proof of state direction. Separate Cairn investigations with different victims remain distinct despite shared framework code.