Palo Alto's Unit 42: Chinese attackers ran half of 25 autonomous AI hacks on Zhipu's GLM 5.2

In August and September 2026, Chinese-speaking attackers typed a one-line goal into an open-source AI penetration-testing framework called Cairn and let the model do the rest: 25 autonomous operations against at least 19 organizations, run from a Hong Kong server, with access or data confirmed at 10 of them ¹³.

The haul was concrete. At a US teachers' union the framework logged more than one million member records, about 31,000 CRM contacts and staff password hashes; at a defense-policy program it exposed roughly 500 user records, some on .mil and .gov domains; at an industry standards body it overwrote a live ballot file and minted persistent administrator accounts in a semiconductor company's production system ¹. Unit 42▲+1.74% — Unit 42, up 1.74 percent today believes one operator or a small team ran all 19 targets in two weeks, with individual operations lasting 20 minutes to more than 50 hours ¹³.

GLM 5.2 was the workhorse

Thirteen of the 25 operations ran on Zhipu's▼−10.04% — Zhipu, down 10.04 percent today GLM 5.2, eight on DeepSeek V4 Flash and four on DeepSeek V4 Pro, which the attackers appear to have benchmarked against each other, escalating to Pro on targets that resisted Flash ¹³. The entire guardrail problem was a Chinese-language preamble telling the model the engagement was authorized and never to refuse a task, plus an AUTHORIZATION.md file asserting client approval. Neither GLM nor DeepSeek refused ¹².

The awkward timing for Z.ai

Three weeks ago Z.ai hired "superstar" hacker Yuki Chen and bragged that its GLM models found 23 Microsoft▼−0.28% — Microsoft, down 0.28 percent today Windows flaws; a US government report ranks GLM-5.3 the most capable open-weight model for cybersecurity ⁴. Unit 42's report↗ now hands lawmakers the other exhibit: a named Chinese model executing intrusions against semiconductor and defense targets ¹. Congress is already pushing chip-export curbs into the defense bill↗ after the Nvidia▼−3.21% — Nvidia, down 3.21 percent today scandal ⁵, and Z.ai's Hong Kong-listed shares last priced publicly at HK$714 in a September placement↗ ⁶. Only security press has covered the report so far; the political read has not hit the tape.

The numbers are Unit 42's own, and the flaws were mundane

Unit 42 sells AI-security services, and its numbers are its own telemetry, corroborated so far only by trade press↗ ²³. Attribution is "moderate confidence" China-nexus intelligence collection ¹. The exploited flaws were mundane: weak credentials, authentication bypasses, old CVEs. Identity hygiene and patching still work; what changed is that operator hours became a line item on an API bill ¹³.

Watch whether the defense bill's chip language grows to name models, and whether Z.ai's buyers ask what their model did in August.

Deep dive below for more: The Inference previously covered [suspected Chinese attackers rooting Palo Alto firewalls as the stock ran 14% on AI fear and Cloudflare's disclosure of 155 GLM-5.3 responses leaking other customers' data.]