# Inside Cairn: exposed panels reveal an AI agent intrusion campaign

> More than 20 control panels of Cairn, an open-source AI penetration-testing engine, were left open to the internet by the attackers running them.

- **Severity:** Info: Research, tools, evals or lab claims with no direct exposure. Context, not an alert.
- **Category:** Incident
- **Published by:** NorForge
- **Disclosed:** 2026-10-19
- **Affects:** Cairn, E-commerce websites, Magento
- **Research by:** Snorre Fagerland
- **Primary source:** https://norforge.com/blog/inside_cairn
- **Page:** https://theinjection.dev/items/norforge-inside-cairn/

NorForge found more than 20 internet-exposed control panels of Cairn, an open-source AI penetration-testing engine, and read the operators' own task logs. Three financially motivated clusters ran agents against e-commerce and payment sites.

## What happened

NorForge published Inside Cairn on October 19, 2026, written by researcher Snorre Fagerland. Gambit Security had reported in September 2026 on a criminal campaign against online marketplaces, and the recovered staging server named Cairn among the attacker's AI harnesses. NorForge then searched Shodan and Censys for exposed harness interfaces, found a handful of open Cairn panels with more coming online within days, and after filtering out empty, protected and apparently legitimate installations identified more than 20 likely malicious ones.

## How it works

Cairn treats an intrusion as a state-space search: given an origin and a goal, agent workers run an observe-orient-decide-act loop and post confirmed findings as Facts to a shared blackboard, coordinating only through that board rather than talking to each other. Operators add Hints to steer the search, and a Dispatcher schedules tasks and manages containers. Because the panels were unprotected, that whole board was readable, exposing operator task goals, discovered facts and harvested credentials. NorForge says the panels also appear to expose administrative controls for starting, stopping, redirecting and restarting projects, but states it did not test whether those controls work without authorization.

## Who is affected

Three clusters appear in the data, all of which NorForge assesses as financially motivated with no obvious state sponsorship. AIA0001 runs 14 Chinese-language dashboards holding more than 1,100 attack projects, aimed at persistent access to e-commerce and payment infrastructure mostly in the United States, Japan and Australia. AIA0002 runs 10 English-language panels focused on cards, crypto, merchant payment, pharma and African commerce sites, and AIA0003 is a single exploratory panel with 59 projects.

## What to do

Treat this as broad automated probing of e-commerce and payment stacks rather than targeted attack, and prioritize the paths AIA0001 explicitly sought: unauthenticated remote code execution and file-upload endpoints that yield an uploader shell. Rotate credentials that may sit in web application configuration, because NorForge ran Trufflehog over the panel data, found hundreds of secrets and verified 11 percent of them as still valid.

## Quick facts

- **Panels found:** More than 20 likely malicious, after filtering out legitimate ones
- **Clusters:** AIA0001 (Chinese, 14 panels), AIA0002 (English, 10), AIA0003 (English, 1)
- **Largest cluster:** AIA0001, more than 1,100 attack projects
- **Success rate:** About 10 percent, which NorForge calls a reasonable assumption, not a measurement
- **Cost:** About $5 per task on average; over $100 for projects above 1,000 intents and facts
- **Time to goal:** A little under 23 hours on average for AIA0001 projects that reached their goal
- **Confirmed:** One live uploader webshell at a hardware parts vendor, plus one validated US retailer case

## Questions

### Is Cairn itself malicious software?

Cairn is a general-purpose AI state-space search engine published under AGPL-3.0, and its README presents autonomous penetration testing as the first use it was validated on, alongside vulnerability research, mathematical proof and CTF challenges. The project disclaimer states that Cairn is intended only for environments where the user has explicit authorization. NorForge's report concerns attackers running their own Cairn deployments, not a flaw in the project.

### Which models did the Cairn operators run?

NorForge read worker names from the exposed panels rather than observing the models directly. Cluster AIA0001 used a worker named claudecode_deepseek-v4.1-flash and AIA0002 one named pi_openrouter_deepseek, which NorForge says could mean a Claude Code harness driving DeepSeek models and the Pi agent reaching DeepSeek through OpenRouter. NorForge treats that model attribution as unconfirmed.

### How much of the Cairn campaign did NorForge verify itself?

NorForge confirmed a live uploader webshell on a large hardware parts vendor's site and validated one very large US retailer case directly. Victim names reported elsewhere came from Reuters, not from NorForge, which did not identify victims in its technical report. NorForge marks the roughly 10 percent success rate, the cost figures and the model attribution as estimates with considerable uncertainty.

## Sources

1. [NorForge Report](https://norforge.com/blog/inside_cairn)
2. [Cairn Project](https://github.com/oritera/Cairn)