Plan ahead High Check your exposure
Attackers used an open-source AI hacking tool against manufacturing and defence firms
Help Net SecurityPalo Alto Networks, Cairn · semiconductor, advanced manufacturing, defence
What happened. Palo Alto Networks' Unit 42 found Chinese-speaking attackers used Cairn, an open-source AI penetration-testing framework, in 25 operations against at least 19 organisations in August and September 2026. They gained access or pulled data at 10.
Who is affected. Mostly semiconductor and advanced-manufacturing supply-chain firms (seven) and defence organisations (three), according to Help Net Security.
What to do. Review which of your systems are reachable from the internet and close or patch any that are not needed.
When to act. Plan ahead: Manufacturing operators: AI-driven intrusions reached ten organisations; review internet-facing access.
Editor's reading
Fordetection engineerIT securityleadership
- Purdue level
- L5
- L4
Why: The report describes attackers who needed little more than a domain name, so the activity starts at the internet edge (L5) and reaches business systems (L4).
- Are you exposed?
Review the internet-facing hosts and services linked to your company domains for unpatched software, open management interfaces and weak logon controls.
- If you cannot fix it yet
- Remove or restrict internet-facing services that are not essential, starting with anything tied to your company domain names.
- Enforce multi-factor authentication on all remote and externally reachable logons.
- Watch for
- Rapid, automated probing of internet-facing hosts from a single source, followed by successful logons.
- Unexpected data transfers out of internet-facing systems.
Inferred from the facts above, not stated by the source. Check it against your own site before acting.