Exposed Cairn AI Panels Reveal Autonomous Hacking Against Over 1,100 Targets
Do Son 
Project creation activity across the three clusters | Image: NorForge
TL;DR
Security researchers discovered more than 20 unsecured control dashboards for the Cairn AI hacking tool left open on the public internet. These exposed Cairn AI panels revealed over 1,100 automated attack projects targeting online retailers and payment systems worldwide. Because the operators failed to password-protect their dashboards, investigators uncovered stolen victim secrets. In addition, they found the attackers’ own server credentials.
What Happened in the Investigation
In September 2026, researchers at Gambit Security investigated a criminal intrusion targeting online marketplaces and recovered an attacker staging server running AI harnesses named Hermes, Strix, and Cairn. Building on those findings, NorForge researchers scanned the internet using Shodan and Censys to locate web interfaces for these autonomous tools. Consequently, the team discovered more than 20 unauthenticated Cairn AI panels linked to financially motivated cybercriminals. There were also several exposed dashboards run by legitimate red teams.
“In this setting, Cairn is an AI-powered hacking system. Give it a target and an objective, and it can coordinate AI agents to investigate the target, search for security weaknesses, and attempt to break in,” NorForge wrote in its report. Inside the Cairn AI hacking tool, each attack runs as a project moving from a starting point toward a defined goal. Autonomous workers post discovered facts and next-step intents onto a shared digital blackboard until they breach the target.
Automated Exploitation and Tooling
Before feeding websites into the Cairn AI panels, attackers used Microsoft’s Playwright browser automation framework to verify that target stores could process orders. Once tasked, the autonomous agents operated inside Kali Linux containers equipped with Nmap, ffuf, OWASP Amass, PHPGGC, and a proof-of-concept exploit for the Magento StyleSmuggler flaw (CVE-2026-75650). Notably, an exposed agent directory revealed that criminals had repurposed a container configuration from a Tencent capture-the-flag competition.
In one verified intrusion against a major U.S. hardware parts vendor, an agent exploited unauthorized write access to a memcached session store and unsafe PHP object deserialization in legacy Zend Framework components. As instructed, the agent uploaded an HTML file-uploader webshell to the retailer’s server. NorForge estimated that running an average attack task with the DeepSeek 4.1 Flash model costs criminals only about $5. More complex multi-day runs cost around $100.
Who Is Behind the Activity
NorForge grouped the malicious Cairn AI panels into three distinct clusters based on language, hosting providers, and target selection. The largest group, tracked with high confidence as AIA0001, operates in Chinese and managed over 1,100 attack projects across 14 dashboards hosted on Cgi Global Limited (AS56594). This cluster used a worker named claudecode_deepseek-v4.1-flash to hunt for unauthenticated remote code execution and SQL injection flaws on shopping sites in the United States, Canada, Japan, and Australia. Curiously, a buggy domain script used by AIA0001 stripped the first letter “w” from target URLs. Consequently, words like “wholesale” turned into “holesale.”
Meanwhile, a second high-confidence cluster named AIA0002 operated 10 English-language panels hosted on Vultr instances via The Constant Company (AS20473). Using a worker named pi_openrouter_deepseek, AIA0002 targeted merchant payment processors, pharmaceutical stores, African commerce sites, and even an underground carding market. “It is interesting to see that many projects seem to have no technical starting instructions, beyond ‘fetch credit cards’ or ‘fetch crypto’. The agents just go from there,” the researchers noted. A third, low-confidence cluster named AIA0003 ran 59 projects on a single AlexHost panel (AS200019) targeting small and large U.S. platforms.
Impact and Operational Exposure
Across the observed campaigns, the autonomous agents achieved an average breach success rate of roughly 10%. For successful intrusions conducted by AIA0001, the Cairn AI hacking tool needed just under 23 hours on average to reach its goal. It generated about 140 facts per target. However, the attackers’ rush to deploy autonomous tools created massive operational security failures.
When NorForge scanned the exposed project data with Trufflehog, they found hundreds of leaked secrets, with 11% verified as active credentials. These leaks included victim API keys, database passwords, and even root SSH logins to the criminals’ own backend staging servers. “Whatever offensive expertise these operators possess, securing their own infrastructure does not appear to be among their strengths,” NorForge concluded.
How Organizations Can Stay Protected
NorForge is working alongside Reuters to notify compromised companies and request hosting takedowns for the exposed Cairn AI panels. Because autonomous agents scan heavily for unpatched content management flaws, e-commerce administrators must apply security updates for Magento, Odoo, and legacy PHP frameworks immediately. Furthermore, defenders should audit web directories for hidden HTML uploader scripts and restrict public access to memcached servers. Finally, legitimate penetration testing teams must place their management dashboards behind strict authentication and virtual private networks to avoid leaking client vulnerabilities online.
Support Our Threat Intelligence
Find our threat intelligence and malware analysis helpful? Support our work today and unlock a 100% ad-free reading experience!
Buy Me a Coffee
