NorForge Details 20+ Exposed Cairn Panels Used in AI-Driven Intrusions

Security research firm NorForge on October 19, 2026 published Inside Cairn, an investigation that identified more than 20 publicly exposed control panels for the Cairn AI problem-solving harness as likely associated with malicious, financially motivated intrusion activity. The exposed panels provide a detailed view of how threat actors choose targets, task autonomous agents, exploit vulnerabilities, and establish persistent access in compromised systems, the firm said.

The report was written by Snorre Fagerland, a founding researcher at NorForge, an employee-owned company founded in 2026 with a US parent headquartered in Palo Alto and a European operating subsidiary. Because the panels reveal target identities, uncovered weaknesses, account secrets, API keys, and compromise status, NorForge said it aggressively redacted extracted data and is withholding panel addresses until they can be taken down. The firm added that a considerable number of apparently legitimate red-team operations were also found exposed in the same way, potentially placing their clients at risk.

How the Panels Surfaced

NorForge said its searches began after Gambit Security reported in September 2026 on a criminal intrusion campaign targeting online marketplaces that used AI harnesses including Hermes, Strix, and Cairn, tools whose web interfaces are often left unsecured on the open internet. Quick searches on the Shodan and Censys search engines revealed hosts running what appear to be AI harnesses, and NorForge said Cairn proved to be one of the most neglected platforms. Continued scans showed new panels coming online in short order, with targeting information, language, and instructions tying many of them to the same threat actors.

In Gambit Security’s September 22, 2026 interim report, the firm said a financially motivated operator ran Strix for vulnerability search, Cairn for autonomous end-to-end exploitation, and Hermes for orchestration, launching 105 attack projects between September 10 and 15 alone and compromising at least 27 companies, in activity dating to July 2026. Gambit reported more than 600,000 unexpired credit card records taken from two companies, card-skimming scripts confirmed in place on 19 sites with more than 100 further infected websites detected alongside researcher Varys, and an operator cost review averaging $25.46 across 101 completed scans.

Inside the Cairn Harness

NorForge describes Cairn less as an autonomous penetration-testing engine than as a state-based problem-solving engine. Each task is a project with a start point called an origin and a predefined end goal, and the framework progresses in cycles of facts (discoveries the agent has made) and intents (what it has decided to do next), all posted to a project-internal blackboard that human operators can also seed with hints. One illustrated project graph, directed at a major US online retailer, ran from origin to goal and ended at the state the harness records as goal met: a webshell injected into the site. A captured operator task on another open panel exposed secrets that included what NorForge described as root access to the attacker’s own data drop.

Three Activity Clusters

The largest cluster, designated AIA0001, uses Chinese language and spans 14 panels hosted via AS56594, Cgi Global Limited; NorForge assesses it as malicious with high confidence. It holds more than 1,100 attack projects, making it by far the most active exposed actor the firm found, and targets organizations mostly in the US, Japan, and Australia with the apparent aim of gaining persistent access to e-commerce and payment infrastructure for later monetization, NorForge reported. Across all the exposed panels, the firm said, the activity appeared financially motivated, with no obvious state-sponsored intrusion activity.

A typical automated AIA0001 task, translated by NorForge, lists confirmed real shopping sites in four countries (the US, Canada, Japan, and Australia) with traffic between 200,000 and 1.5 million, pre-validated with Microsoft’s Playwright browser-automation framework to confirm orders can be placed. The stated objective is to find unauthenticated remote code execution, with priorities including login SQL injection, unauthenticated endpoints, file uploads, deserialization, authentication bypass, and account takeover, delivering an uploader shell payload rather than a command-executing webshell. NorForge said the feeding pipeline relies on extensive automation, including a shared, buggy domain normalizer that strips one letter w too many from the www prefix, turning wholesale into holesale, which made related panels easy to spot.

During a brief window when one AIA0001 host opened a web server on a high port for out-of-band testing, NorForge browsed an agent worker’s directory and inventoried tooling that included Playwright and Chromium, PHPGGC gadget-chain payloads, a proof-of-concept and Docker-based validation lab for the StyleSmuggler Magento vulnerability tracked as CVE-2026-75650, OWASP Amass, dnsrecon, the ffuf web fuzzer, Nmap, and the rockyou password wordlist. One agent task update indicated the Kali container setup had been repurposed from a Tencent tsec penetration-test competition framework; NorForge said this is almost certainly criminals reusing existing tools and that there is no reason to believe Tencent had anything to do with the operation. All observed AIA0001 tasks were performed by a worker named claudecode_deepseek-v4.1-flash, which the firm said could mean a Claude Code harness running the Chinese DeepSeek 4.1 Flash model released in September 2026.

Without actual token-usage data, NorForge estimated the average cost of an AIA0001 task at around $5, including unsuccessful projects that end early, while projects exceeding 1,000 intents and facts could cost more than $100. The firm stressed that the uncertainty in those figures is considerable and the numbers could be off by a clear margin, while concluding the operations are relatively cheap even so.

A second cluster, AIA0002, uses English across 10 panels hosted via AS20473, The Constant Company, in most cases Vultr VPS instances, and is assessed as malicious with high confidence, though some panel links are less certain and many have gone dark since the investigation began. Its operators openly discuss stealing credit cards and cryptocurrencies and uploading stolen data to hosts under their control, expose SSH logins to backend staging hosts inside their taskings, and frequently give no technical starting instructions beyond directives such as “fetch credit cards” or “fetch crypto.” Project records show workers named pi_openrouter_deepseek, suggesting the Pi coding-agent framework using DeepSeek models through OpenRouter, a third-party model API gateway. Targets center on merchant payment services, gray-market payment sites, and pharmaceutical sites, including a clearly criminal carding site, while several African commerce sites hint the actor may be based on that continent, NorForge reported. The actor also uses Cairn as a general-purpose service engine, for example to move funds between crypto wallets.

A third cluster, AIA0003, exposes a single panel listing 59 projects, hosted on AS200019, AlexHost, and using exclusively English. Its targets mix smaller e-commerce sites with very large US commercial platforms, and its projects start out claiming to be authorized assessments before gradually becoming explicit about obtaining shell access, admin-panel access, or database access. NorForge assesses this actor as malicious with low confidence and describes it as more exploratory.

Verified Compromises and Success Rates

NorForge verified one claimed intrusion by fetching the shell URL recorded in a completed task against a large hardware parts vendor; the URL served a live uploader webshell. According to the agent’s own explanation, that intrusion was enabled by unauthorized write access to a memcached session store, combined with unsafe PHP object deserialization and an exploitable gadget chain in legacy Zend Framework components.

Across the observed campaigns, NorForge estimated average success rates at around 10%, with many remaining tasks achieving partial goals or gathering information usable in later attempts. For AIA0001 tasks that reached their goals, the average time from project start to goal met was a little under 23 hours, generating an average of 140 facts per project, though one project ran for more than five days. The firm cautioned that the numbers are a snapshot in time, because models and harnesses evolve very quickly.

Exposed Secrets and Takedown Efforts

Running the Trufflehog secrets scanner over data from the exposed Cairn instances returned literally hundreds of secrets of different kinds, from relatively trivial to extremely serious, with 11% verified valid, NorForge reported. The panels also appeared completely unprotected, exposing what looked like the harness’s full administrative functionality, including controls for starting and stopping projects, interfering with ongoing operations, inserting new data, redirecting agents to different targets, and restarting old projects; NorForge said it did not test whether those controls work without authorization.

In its conclusion, NorForge said the attackers are compromising their own operational security in the rush for quick results and exposing their targets to a far larger attack surface than intended, while legitimate red teams risk gathering client secrets and publishing them on the open internet. The report closes with six redacted case studies covering an Australian e-commerce site, a restaurant point-of-sale compromise, three US retailers, and a Japanese retailer. NorForge said it validated one of them, a compromise of a very large US retailer in which the agent found the single cookie setting that selected a vulnerable backend server.

NorForge said it is cooperating with Reuters in notifying victims that appear to have suffered compromise and is attempting to get the offending Cairn panels taken down, an effort it said depends heavily on how hosters respond to takedown requests. The firm published redacted indicators of compromise for the panels and staging servers and said it will provide the unredacted list to bona fide security researchers on request.