Cairn agent panels used in intrusions: NorForge finds 20+ suspect panels, Reuters says 100+ companies were breached
On October 19, NorForge said 20+ exposed Cairn agent panels likely used in attacks, with 1,100+ projects in one cluster. Reuters says 100+ firms were breached.
Cairn is an open-source AI problem-solving engine released under the AGPL-3.0 license. Its repository describes it as a general-purpose problem-solving engine, “validated first on autonomous penetration testing.” On October 19, the security firm NorForge published research on more than 20 publicly exposed Cairn control panels that it considers likely tied to malicious activity. The busiest cluster, which uses Chinese, ran more than 1,100 attack projects. The same day, Reuters reported that a Chinese-speaking attacker used agents to break into the websites of more than 100 companies, naming John Deere, SharkNinja and Cummins.
Key points
- NorForge grouped more than 20 suspect Cairn panels into three clusters. The most active one, a Chinese-language cluster it labels AIA0001, has 14 panels and over 1,100 attack projects aimed at e-commerce sites in the US, Canada, Japan and Australia.
- Reuters says the attacker began on September 25 and had tried to break into more than 1,200 sites as of late last week. A successful intrusion typically took around 23 hours.
- The cost figures use different methods. NorForge estimates about $5 per task, including failed ones, and calls its roughly 10% success rate a reasonable assumption. Reuters relays an estimate of about $50 per successful hack.
Background
Cairn had shown up in criminal activity before this report. On September 22, Gambit Security published findings on a financially motivated operator who used three open-source agent frameworks against online retailers: Strix to find vulnerabilities, Cairn for autonomous end-to-end exploitation, and Hermes to orchestrate the campaign. Gambit says that between September 10 and 15 alone, the operator launched 105 attack projects and compromised at least 27 companies to varying degrees. The activity dates back to July 2026, and Gambit says it is still running. Gambit’s report says the Cairn attacks used DeepSeek v4.1 Flash. It does not attribute the operator to a named group or country.
Cairn’s own description does not match how outsiders describe it. The README says penetration testing is “the first domain it has been validated on,” and it asks users to operate only in environments where they have explicit authorization. Gambit calls Cairn “an autonomous penetration testing engine.” NorForge says that is “not entirely accurate”: the engine can be used that way, but its use case is broader, a state-based engine that moves step by step toward a goal. At the time of our check, the repository had about 3.7k GitHub stars.
India’s national cybersecurity agency, CERT-In, also treats this class of tool as a risk. Its critical advisory of October 15 lists misuse of open-source agentic AI tools as one category of intrusion. It does not name Cairn, and we covered it separately. In late September, Anthropic’s threat report also put open-weight model capability in focus; our GLM-5.3 report has the details.
The facts
NorForge’s research and Reuters’s reporting give the figures below. They come from different methods, so do not compare them directly.
| Item | Figure | Source and basis |
|---|---|---|
| Suspect panels | More than 20 | NorForge, in three clusters |
| Chinese-language cluster (AIA0001) | 14 panels, over 1,100 attack projects | NorForge, high confidence |
| English cluster (AIA0002) | 10 panels, aimed at card data and crypto | NorForge; many panels have since gone offline |
| Single-panel cluster (AIA0003) | 1 panel, 59 projects | NorForge, low confidence |
| Time to goal for successful projects | A little under 23 hours | NorForge, mostly AIA0001 |
| Success rate | About 10% | NorForge calls it a reasonable assumption |
| Cost per task | About $5, including failed tasks | NorForge, with considerable uncertainty |
| Sites attempted | More than 1,200 | Reuters, as of late last week |
| Cost per successful hack | About $50 | Reuters, relaying Fagerland’s estimate |
| Exposed secrets | Hundreds; 11% verified valid | NorForge, scanned with Trufflehog |
NorForge also says every task it examined ran on a worker named claudecode_deepseek-v4.1-flash. It says that could mean a Claude Code harness running the DeepSeek 4.1 Flash model. Reuters describes the campaign as appearing to mix DeepSeek with Anthropic’s Claude Code.
NorForge also checked one claimed intrusion. A shell address from a completed task served an uploader web shell on the website of a large hardware parts vendor. That kind of shell is a form that saves uploaded files; it cannot run commands by itself. NorForge warns, however, that attackers can swap in something more dangerous at any time.
What others say
Reuters’s exclusive includes responses from the three named companies, and they differ. Deere said it had taken “necessary remediation actions” and saw “no indication that sensitive information was accessed.” SharkNinja said the incident hit a standalone site that carried only product support information, and that the threat had been contained. Cummins said it was investigating a potential cyber-attack on a website run by a third-party vendor. Reuters also reports that two smaller businesses acknowledged being compromised, that other victims listed in the Cairn data did not respond, and that it could not establish how much data was taken.
The numbers need careful reading. Reuters’s lead says more than 100 companies were broken into. Its body gives more than 1,200 attempted sites and the three named companies, and it does not list the 100. NorForge names no victims and gives no figure of 100. The Verge attributes “more than 100 websites” and “mostly operated on their own” to NorForge. NorForge’s text describes “autonomous and semi-autonomous” agents but does not quantify them. TNW says it has not independently verified the intrusions.
The author, who posts as le1xia0, says Cairn “was never a ‘hacking tool.’” The Verge quotes the author as saying misuse is a human decision, not a feature of the engine. Reuters quotes a post in which the author says that if the project is used to carry out harmful hacking attacks, that is not the intention. Reuters says the author acknowledged receipt of a Reuters message but did not immediately answer a list of questions.
Our take
For operators, the most direct point is that an exposed agent panel is a leak in itself. NorForge says that having a site tested on an open Cairn instance is often a serious security problem, whatever the test outcome, because the panels store findings, instructions, credentials and targets. One thing you can do in a minute is search your own domains and IP ranges on Shodan or Censys for agent consoles. NorForge’s first searches for these panels used the same two engines. If you find one, take it off the public internet first, then add authentication.
The author has a point. Cairn is a general solver, attacks are one use among many, and the README says use requires authorization. But the same README names penetration testing as its first validated domain, and its topics include ai-hacking, penetration-testing and ctf-tools. A project that presents itself that way has a hard time saying it was never an attack tool. This is our judgment, not a conclusion from NorForge or Reuters.
Keep the numbers apart. The 10% success rate is an assumption. The $5 per task is an estimate with wide uncertainty. The $50 per successful hack is a rough figure Reuters relayed. Gambit’s average of $25.46 per scan comes from the operator’s own cost review of 101 completed scans. These figures have different denominators, so they should not be merged into a single “attack cost.”
Whether the two reports describe the same people is not established. Both put Cairn on DeepSeek 4.1 Flash, and both involve Chinese: Gambit reports that the operator typed instructions in Chinese, and NorForge’s largest cluster is Chinese-language. Neither report links its activity to the other. NorForge mentions Gambit only to say that Gambit found Cairn on an attacker’s server.
The CERT-In advisory is a neighboring case, and any link to Cairn is inference. It describes misuse of open-source agentic AI tools, but it does not name Cairn and does not use the words penetration or CTF. Reading it as an official warning about the same class of problem is reasonable. Saying its cases involve Cairn goes beyond the text.
What to watch
NorForge says it is working with Reuters to notify victims and is asking hosting providers to take the panels down, but it acknowledges that may not be possible. It will not publish panel addresses until they are offline. Three things are worth tracking: whether victims confirm the intrusions, whether the panels go offline, and whether the Gambit and NorForge activity turns out to be linked. Nothing so far shows that link.