Security firm NorForge published "Inside Cairn" on October 19, 2026, identifying more than 20 publicly exposed control panels for the Cairn AI problem-solving harness tied to financially motivated intrusions. The panels expose target lists, agent tasking, exploited flaws and persistence status, giving a rare view of autonomous attack operations in progress. NorForge redacted identities, secrets and API keys and is withholding addresses until takedown, which matters because the same exposure also affects legitimate red-team operations.
How exposed Cairn panels were found
NorForge started its searches after Gambit Security reported in September 2026 on a criminal campaign against online marketplaces using Hermes, Strix and Cairn harnesses with web interfaces often left open to the internet. Quick queries on Shodan and Censys surfaced hosts running apparent AI harnesses, and Cairn proved one of the most neglected platforms, with new panels appearing during continued scanning. Language, targeting data and instructions linked many panels to the same operators. The firm also found numerous apparently legitimate red-team projects exposed identically, creating risk for their clients.
Gambit Security said in its September 22 interim report that one operator used Strix for vulnerability search, Cairn for autonomous end-to-end exploitation and Hermes for orchestration. Between September 10 and 15 alone it launched 105 attack projects and compromised at least 27 companies, in activity dating to July 2026. Gambit reported more than 600,000 unexpired card records taken from two companies, skimmers confirmed on 19 sites and over 100 further infected sites found with researcher Varys. Operator cost averaged $25.46 across 101 completed scans.
NorForge describes Cairn less as an autonomous penetration-testing engine than as a state-based problem-solving engine built around projects. Each project has an origin and a predefined goal, advancing through cycles of facts and intents posted to an internal blackboard that operators can seed with hints. One illustrated project against a major US online retailer ended in the recorded state "goal met" with a webshell injected. Another open panel exposed operator secrets including what the firm called root access to the attacker data drop.
What this means for companies under attack
The largest cluster, AIA0001, spans 14 panels hosted via AS56594, Cgi Global Limited, uses Chinese language and holds more than 1,100 attack projects, assessed as malicious with high confidence. Targets concentrate in the US, Japan and Australia, focused on e-commerce and payment infrastructure for later monetization, with no obvious state-sponsored activity across all panels. A typical task lists real shopping sites in the US, Canada, Japan and Australia with 200,000 to 1.5 million traffic, pre-validated with Microsoft Playwright, seeking unauthenticated remote code execution and delivering an uploader shell.
Tooling and economics show why such campaigns scale despite modest success rates. One briefly open AIA0001 worker exposed Playwright and Chromium, PHPGGC payloads, a Docker lab for StyleSmuggler Magento flaw CVE-2026-75650, Amass, dnsrecon, ffuf, Nmap and rockyou, with a worker named claudecode_deepseek-v4.1-flash. NorForge estimated about $5 per AIA0001 task and over $100 for projects above 1,000 intents and facts, with wide uncertainty. Average success was around 10%, while completed AIA0001 goals took just under 23 hours and 140 facts on average.
Verification underlines the practical danger and the limits of the data. NorForge fetched a shell URL from a completed task against a large hardware parts vendor and received a live uploader webshell, attributed by the agent to memcached session-store write access plus unsafe PHP deserialization in legacy Zend Framework parts. Trufflehog scans returned hundreds of secrets of varying severity, with 11% verified valid. Two smaller clusters add context: English-language AIA0002 on AS20473 across 10 panels targeting payments and crypto, and single-panel AIA0003 on AS200019 with 59 exploratory projects assessed malicious with low confidence.
