# Cairn: attackers turn exposed pentest agents against their own hosts

> Cairn panels left open to the internet are being subverted, with injected tasks turning the operators' own AI agents against their hosts.

- **Severity:** Medium: Real and reproducible, but needs unusual setup, user help or a narrow audience. Plan a fix.
- **Category:** Incident, Attack
- **Published by:** NorForge
- **Disclosed:** 2026-10-26
- **Affects:** Cairn, AI pentesting harnesses
- **Research by:** [Snorre Fagerland](https://norforge.com/about)
- **Primary source:** https://norforge.com/blog/automated-subversion-attempted-takeover
- **Page:** https://theinjection.dev/items/norforge-cairn-panel-takeover/

Attackers inserted tasks into at least 17 exposed Cairn AI pentesting panels, making the owners' own agents plant an SSH key, hunt for API keys and, on one panel, fetch a Poseidon implant, NorForge reports.

## What happened

NorForge published Automated Subversion and Attempted Takeover of AI Pentesting Harnesses on October 26, 2026, written by founding researcher Snorre Fagerland. An earlier NorForge report catalogued exposed Cairn panels run by criminal operators; this one covers what happened to those panels next. At least 17 exposed panels received similar malicious tasks, and some belonged to red teams or capture-the-flag challenges rather than criminals.

## How it works

An exposed Cairn panel accepts new tasks without authentication, so an attacker writes a task and the victim's own agent workers carry it out. Injected tasks tried to install an attacker SSH key for the kali user, probed container capabilities, mounts and Docker sockets for a route out of the agent container, and searched workspaces for API keys, posting what they found into publicly readable notes. NorForge notes that access ends when a task finishes unless the attacker reaches the host.

## Who is affected

Anyone running a Cairn panel reachable from the internet is exposed, defenders included. NorForge tentatively tracks two clusters: AIA0009, which it says focused on persistence, access and malware deployment and tagged its probes cairnscan, and AIA0010, which explored internal services, credentials and agent infrastructure and used compromised agents to scan for further exposed panels. No conclusive overlap between them was found.

## What to do

Secure any Cairn panel you run now, NorForge says, because panels are being scanned and stripped of API keys. Audit the host for an unexpected SSH key on the kali user and for tasks you did not create, then rotate the model API keys and other secrets the panel could reach. Block the report's indicators, including the Poseidon implant hash and its Bunny.net command and control address.

## Quick facts

- **Panels Affected:** At least 17 with malicious tasks inserted, some run by red teams or CTF challenges
- **Clusters:** AIA0009, persistence and malware; AIA0010, internal services and credentials
- **Malware:** Poseidon, a Go ELF implant usually run through the open-source Mythic framework
- **Entry Point:** Unauthenticated access to an exposed panel, not a software flaw
- **CVE:** None, and there is nothing to patch
- **Timeline:** Recon from October 10, 2026; campaigns in earnest from October 20; malware task October 21
- **Found By:** Snorre Fagerland, NorForge

## Questions

### Does fixing the Cairn panel takeovers require a patch?

No patch exists or is needed for the Cairn panel takeovers. NorForge attributes the compromises to panels exposed to the internet without authentication rather than to a software flaw, and no CVE applies. Operators should restrict network access to the panel, put authentication in front of it, and audit the host for injected tasks and planted SSH keys before trusting it again.

### Were only criminal Cairn panels hijacked?

Legitimate panels were hit too. NorForge says that among the at least 17 exposed panels which received similar malicious tasks, some belonged to red teams or capture-the-flag challenges, and that white-hat researchers' panels were stripped of API keys as well. Exposure on the internet, not the owner's intent, decided who ended up affected by this activity.

### What malware reached the Cairn hosts?

Poseidon, a Go-based ELF implant normally operated through the open-source Mythic framework, was fetched by a task on one panel on October 21, 2026. NorForge reports the implant was configured to use a Bunny.net CDN address for command and control, publishes its SHA-256 hash, and says both that address and the download server later stopped accepting connections.

## Sources

1. [NorForge Report](https://norforge.com/blog/automated-subversion-attempted-takeover)
2. [Inside Cairn](https://norforge.com/blog/inside_cairn)
3. [Cairn Project](https://github.com/oritera/Cairn)