--- title: "Palo Alto's Unit 42: Chinese attackers ran half of 25 autonomous AI hacks on Zhipu's GLM 5.2" description: "Unit 42's telemetry shows one operator used Zhipu's GLM 5.2 for 13 of 25 autonomous intrusions that reached a teachers' union and .mil and .gov accounts. The report hands Washington a named Chinese model as chip curbs gain votes, and lands on Z.ai's Hong Kong holders." publisher: "The Inference" section: "Security" published: 2026-11-13T18:16:51.660Z modified: 2026-11-13T18:16:51.660Z canonical: https://theinference.org/article/palo-alto-networks-unit-42-says-chinese-attackers-ran-half-of-25-autonomous-ai-hacks-with-zhipu-s-glm-5-2 language: en keywords: "Cybersecurity, China, AI Safety, Palo Alto Networks, Zhipu AI" --- # Palo Alto's Unit 42: Chinese attackers ran half of 25 autonomous AI hacks on Zhipu's GLM 5.2 > Unit 42's telemetry shows one operator used Zhipu's GLM 5.2 for 13 of 25 autonomous intrusions that reached a teachers' union and .mil and .gov accounts. The report hands Washington a named Chinese model as chip curbs gain votes, and lands on Z.ai's Hong Kong holders. In August and September 2026, Chinese-speaking attackers typed a one-line goal into an open-source AI penetration-testing framework called Cairn and let the model do the rest: 25 autonomous operations against at least 19 organizations, run from a Hong Kong server, with access or data confirmed at 10 of them [1][3]. The haul was concrete. At a US teachers' union the framework logged more than one million member records, about 31,000 CRM contacts and staff password hashes; at a defense-policy program it exposed roughly 500 user records, some on .mil and .gov domains; at an industry standards body it overwrote a live ballot file and minted persistent administrator accounts in a semiconductor company's production system [1]. [Unit 42](https://theinference.org/markets/companies/palo-alto-networks) believes one operator or a small team ran all 19 targets in two weeks, with individual operations lasting 20 minutes to more than 50 hours [1][3]. ## GLM 5.2 was the workhorse Thirteen of the 25 operations ran on [Zhipu](https://theinference.org/markets/companies/z-ai)'s GLM 5.2, eight on [DeepSeek](https://theinference.org/markets/companies/deepseek) V4 Flash and four on DeepSeek V4 Pro, which the attackers appear to have benchmarked against each other, escalating to Pro on targets that resisted Flash [1][3]. The entire guardrail problem was a Chinese-language preamble telling the model the engagement was authorized and never to refuse a task, plus an AUTHORIZATION.md file asserting client approval. Neither GLM nor DeepSeek refused [1][2]. *Chart: **GLM 5.2 ran 13 of the 25 autonomous attack operations** Bars showing 13 operations on Zhipu GLM 5.2, 8 on DeepSeek V4 Flash and 4 on DeepSeek V4 Pro.* *Count of the 25 autonomous intrusion operations by the AI model that ran them, August to September 2026, as documented by Palo Alto Networks Unit 42. Sources: [1][3]. [1][3]* ## The awkward timing for Z.ai Three weeks ago Z.ai hired "superstar" hacker Yuki Chen and bragged that its GLM models found 23 [Microsoft](https://theinference.org/markets/companies/microsoft) Windows flaws; a US government report ranks GLM-5.3 the most capable open-weight model for cybersecurity [4]. [Unit 42's report](https://unit42.paloaltonetworks.com/cairn-framework-ai-autonomous-attacks/) now hands lawmakers the other exhibit: a named Chinese model executing intrusions against semiconductor and defense targets [1]. Congress is already [pushing chip-export curbs into the defense bill](https://www.msn.com/en-us/news/other/explainer-tougher-curbs-on-ai-chip-sales-to-china-likely-after-nvidia-ceo-resigns/ar-AA2hjjix) after the [Nvidia](https://theinference.org/markets/companies/nvidia) scandal [5], and Z.ai's Hong Kong-listed shares last priced publicly at HK$714 in [a September placement](https://thenextweb.com/news/z-ai-5bn-hong-kong-zero-interest-convertible-bonds) [6]. Only security press has covered the report so far; the political read has not hit the tape. ## The numbers are Unit 42's own, and the flaws were mundane Unit 42 sells AI-security services, and its numbers are its own telemetry, [corroborated so far only by trade press](https://www.csoonline.com/article/4247565/palo-alto-tracks-a-massive-chinese-ai-attack-that-sadly-lives-up-to-industry-fears.html) [2][3]. Attribution is "moderate confidence" China-nexus intelligence collection [1]. The exploited flaws were mundane: weak credentials, authentication bypasses, old CVEs. Identity hygiene and patching still work; what changed is that operator hours became a line item on an API bill [1][3]. Watch whether the defense bill's chip language grows to name models, and whether Z.ai's buyers ask what their model did in August. [Deep dive below for more: The Inference previously covered [suspected Chinese attackers rooting Palo Alto firewalls as the stock ran 14% on AI fear](https://theinference.org/article/suspected-chinese-attackers-rooted-palo-alto-networks-firewalls-as-the-stock-ran-14-on-ai-fear) and [Cloudflare's disclosure of 155 GLM-5.3 responses leaking other customers' data](https://theinference.org/article/cloudflare-s-own-disclosure-155-glm-5-3-responses-leaked-other-customers-data-and-z-ai-s-name-travels).] ## Takeaway Unit 42 says one operator ran 25 autonomous intrusions in two weeks, 13 of them on Zhipu's GLM 5.2, giving chip-curb advocates a named Chinese model and putting Z.ai's open weights in the political crosshairs. ## Sources 1. [Palo Alto Networks Unit 42, Attackers Use Autonomous AI to Target Semiconductor, Defense and Civil Society Sectors, 12 November 2026](https://unit42.paloaltonetworks.com/cairn-framework-ai-autonomous-attacks/) 2. [CSO Online, Palo Alto tracks a massive Chinese AI attack that sadly lives up to industry fears, 12 November 2026](https://www.csoonline.com/article/4247565/palo-alto-tracks-a-massive-chinese-ai-attack-that-sadly-lives-up-to-industry-fears.html) 3. [Help Net Security, Attackers breached 10 organizations with an open-source AI pentest framework, 12 November 2026](https://www.helpnetsecurity.com/2026/11/12/cairn-autonomous-ai-cyberattacks/) 4. [South China Morning Post (via MSN), Who is Yuki Chen, China's 'superstar' hacker who just joined AI leader Z.ai?, 20 October 2026](https://www.msn.com/en-xl/money/general/who-is-yuki-chen-china-s-superstar-hacker-who-just-joined-ai-leader-z-ai/ar-AA2fEsEs) 5. [Reuters (via MSN), Explainer: Tougher curbs on AI chip sales to China likely after Nvidia CEO resigns, 12 November 2026](https://www.msn.com/en-us/news/other/explainer-tougher-curbs-on-ai-chip-sales-to-china-likely-after-nvidia-ceo-resigns/ar-AA2hjjix) 6. [The Next Web, Z.ai raises $5bn in Hong Kong including $3bn of zero-interest bonds, 13 September 2026](https://thenextweb.com/news/z-ai-5bn-hong-kong-zero-interest-convertible-bonds) --- Palo Alto's Unit 42: Chinese attackers ran half of 25 autonomous AI hacks on Zhipu's GLM 5.2 — The Inference. Canonical: https://theinference.org/article/palo-alto-networks-unit-42-says-chinese-attackers-ran-half-of-25-autonomous-ai-hacks-with-zhipu-s-glm-5-2