Cairn: attackers turn exposed pentest agents against their own hosts

01What happened

NorForge published Automated Subversion and Attempted Takeover of AI Pentesting Harnesses on October 26, 2026, written by founding researcher Snorre Fagerland. An earlier NorForge report catalogued exposed Cairn panels run by criminal operators; this one covers what happened to those panels next. At least 17 exposed panels received similar malicious tasks, and some belonged to red teams or capture-the-flag challenges rather than criminals.

02How it works

An exposed Cairn panel accepts new tasks without authentication, so an attacker writes a task and the victim's own agent workers carry it out. Injected tasks tried to install an attacker SSH key for the kali user, probed container capabilities, mounts and Docker sockets for a route out of the agent container, and searched workspaces for API keys, posting what they found into publicly readable notes. NorForge notes that access ends when a task finishes unless the attacker reaches the host.

03Who is affected

Anyone running a Cairn panel reachable from the internet is exposed, defenders included. NorForge tentatively tracks two clusters: AIA0009, which it says focused on persistence, access and malware deployment and tagged its probes cairnscan, and AIA0010, which explored internal services, credentials and agent infrastructure and used compromised agents to scan for further exposed panels. No conclusive overlap between them was found.

04What to do

Secure any Cairn panel you run now, NorForge says, because panels are being scanned and stripped of API keys. Audit the host for an unexpected SSH key on the kali user and for tasks you did not create, then rotate the model API keys and other secrets the panel could reach. Block the report's indicators, including the Poseidon implant hash and its Bunny.net command and control address.

Questions people ask

Does fixing the Cairn panel takeovers require a patch?

No patch exists or is needed for the Cairn panel takeovers. NorForge attributes the compromises to panels exposed to the internet without authentication rather than to a software flaw, and no CVE applies. Operators should restrict network access to the panel, put authentication in front of it, and audit the host for injected tasks and planted SSH keys before trusting it again.

Were only criminal Cairn panels hijacked?

Legitimate panels were hit too. NorForge says that among the at least 17 exposed panels which received similar malicious tasks, some belonged to red teams or capture-the-flag challenges, and that white-hat researchers' panels were stripped of API keys as well. Exposure on the internet, not the owner's intent, decided who ended up affected by this activity.

What malware reached the Cairn hosts?

Poseidon, a Go-based ELF implant normally operated through the open-source Mythic framework, was fetched by a task on one panel on October 21, 2026. NorForge reports the implant was configured to use a Bunny.net CDN address for command and control, publishes its SHA-256 hash, and says both that address and the download server later stopped accepting connections.

Sources 3 links, all fetched

1. 1norforge.comNorForge Report
2. 2norforge.comInside Cairn
3. 3github.comCairn Project