highState actoractive22 Oct 2026
Cairn
An AI hacking tool broke into 100+ companies
What happened
Criminal operators used an autonomous attack tool to chain reconnaissance, credential stuffing, and lateral movement across more than a hundred organisations.
Timeline
22 Oct 2026 · 03:30 UTC
Campaign observed
Telemetry links more than 100 intrusions to one toolchain.22 Oct 2026 · 14:00 UTC
Tooling analysed
Analysts describe an autonomous loop of recon, credential replay, and escalation.23 Oct 2026 · 01:00 UTC
Guidance
Agencies urge phishing-resistant MFA and fast credential rotation.
Sources