What happened
On 19 October 2026, NorForge published its analysis of exposed Cairn panels and the malicious projects visible through them. NorForge said its searches began after a September 2026 report identified Cairn and other AI harnesses in a criminal intrusion campaign. NorForge identified more than 20 exposed Cairn panels that it assessed as likely associated with malicious activity. The AIA0001 cluster comprised 14 panels and more than 1,100 attack projects targeting e-commerce and payment infrastructure.
The abused framework was Cairn, an open-source, state-based problem-solving engine that coordinates agent workers through shared project state. Operators supplied targets and end goals, while the agent workers iterated through intents and facts; humans could add hints to the shared blackboard. The agent workers mechanically scanned targets, tested weaknesses and, in confirmed cases, progressed to persistent web-shell access. NorForge observed worker labels including claudecode_deepseek-v4.1-flash and pi_openrouter_deepseek, but did not independently establish the exact underlying model versions.
Independent reporting said one operator attempted more than 1,200 sites and reached websites belonging to more than 100 companies. NorForge estimated an average success rate of about 10%, with successful AIA0001 projects taking a little under 23 hours from start to goal. NorForge confirmed one live uploader web shell that provided command execution on a targeted web server. The reporting named Deere, SharkNinja and Cummins, but the organisations’ disclosed findings did not establish a common level of compromise or data loss.
TruffleHog found hundreds of exposed secrets in panel data, and NorForge said 11% were verified as valid. Observed worker labels included claudecode_deepseek-v4.1-flash and pi_openrouter_deepseek, but those labels do not independently prove the exact underlying model versions. NorForge did not publish the exposed panel addresses while it worked on victim notification and infrastructure removal. The exposed interfaces also included apparently legitimate red-team projects, creating a separate assurance issue for organisations that permit agent-driven testing.
Why this matters now
The significant change is not that AI can assist vulnerability research; that was already established. The new evidence shows inexpensive, reusable agent orchestration operating against live organisations, with an observed path from target selection through exploitation and persistent shell access. Security leaders should therefore treat AI-agent abuse as a current operating model rather than a speculative future capability.
The campaign compresses labour rather than eliminating it. Operators still choose targets and objectives, but the agent workers can sustain low-and-slow testing, retain findings and iterate for many hours. Controls built around short scanning bursts, fixed signatures or a human operator’s working day may fail to connect the complete sequence before access is established.
Commerce and payment environments are particularly exposed because the observed tasking sought unauthenticated remote code execution, account manipulation, upload weaknesses and persistent access. The enterprise consequence is not limited to online retailers: any externally reachable application with weak administrative workflows, permissive upload handling or exposed secrets can be fed into the same operating pattern.
The decision for security leaders
Move the external-application programme from periodic vulnerability discovery to continuous sequence detection. A series of individually low-severity requests may represent one persistent agent project retaining context over many hours. Assign application security and detection engineering to define the events that join scanning, account manipulation, file upload and post-exploitation into one investigation.
Treat agent-driven penetration-testing platforms as privileged infrastructure. Their panels may contain client names, vulnerabilities, credentials, task histories and direct controls over running agents. Require the same identity, logging, isolation and supplier-assurance standards applied to remote administration, CI/CD and security orchestration systems.
Do not treat a project marked successful in an exposed panel as conclusive victim confirmation. Escalate when enterprise telemetry corroborates unauthorised account changes, executable uploads, command execution or secret use. Maintain separate records for external claims, verified exposure and confirmed compromise.
Evidence of closure
- Signed inventory maps each internet-facing application to an accountable owner and current exposure state.
- Retrospective telemetry review finds no unexplained account creation, executable upload or command execution.
- Web-root integrity validation accounts for every newly created or modified executable file.
- Secret-rotation record confirms replacement and dependent-service validation for exposed credentials and keys.
The Security.io assessment
The evidence is unusually valuable because it exposes attacker workflow rather than only final malware or victim reporting. It supports a high-confidence conclusion that financially motivated operators are using AI-agent orchestration against live targets. The number of fully compromised organisations and the amount of stolen data remain less certain because panel records, researcher validation and victim statements do not always establish the same outcome.
Attribution posture: NorForge assessed the exposed panels as financially motivated and found no obvious state-sponsored activity; operator identities remain unresolved. That uncertainty should constrain actor claims, but it does not reduce the operational significance of the observed automation, task persistence and confirmed web-shell access.
The primary control shift is architectural. Enterprises should expect repeated, adaptive interaction with internet-facing applications at costs low enough to make broad target lists economical. The practical defence remains familiar—secure authentication, constrained uploads, secret hygiene and useful telemetry—but detection and response must correlate those controls across a longer, machine-paced sequence.
Questions for the morning meeting
- Can current application telemetry distinguish persistent machine-paced probing from ordinary scanning noise?
- Which internet-facing commerce systems can create administrator accounts, upload executable content or expose secrets without secondary approval?
- Do authorised AI red-team platforms expose client targets, findings or credentials through reachable management interfaces?