NorForge 'Inside Cairn': 20+ exposed control panels of the open-source Cairn AI agent harness show criminal crews running autonomous intrusions; the Chinese-language AIA0001 cluster ran 1,100+ attack projects against e-commerce and payment sites mostly in the US, Japan and Australia, including a webshell on an Australian online store; Reuters names Deere, SharkNinja and Cummins among 100+ breached sites
NorForge researcher Snorre Fagerland published 'Inside Cairn' on 19 October 2026, after scanning Shodan and Censys for AI hacking harnesses whose web panels were left open (searches began after Gambit Security's September report of Strix, Cairn and Hermes being used against online retailers). Cairn is an open-source, state-based 'problem-solving engine': each project has a start point and an end goal, and AI agent workers post facts and intents to a shared blackboard until the goal is met. NorForge found more than 20 exposed Cairn panels it assesses as likely malicious and financially motivated, in three clusters. AIA0001, a Chinese-language actor (high confidence malicious), ran more than 1,100 attack projects across 14 panels, mostly hosted on AS56594 (Cgi Global Limited). Its automated pipeline feeds in real US, Canadian, Japanese and Australian online shops with 200,000 to 1.5 million visits, already checked with Playwright that orders can be placed, and tells the agents to find unauthenticated remote code execution (login SQL injection, unauthenticated endpoints, file uploads, deserialisation, authentication bypass, account takeover) and plant an 'uploader' webshell, aiming at persistent access to e-commerce and payment systems. NorForge's first case study is an Australian e-commerce site where the panel recorded the goal as met; NorForge confirmed a shell giving command execution on its web server, reached through a chain starting with unauthenticated account modification. AIA0002, an English-language crew on about 10 panels mostly on AS20473 (The Constant Company/Vultr), openly tasks agents to steal card data and cryptocurrency and used DeepSeek models through OpenRouter; AIA0003 is a smaller, lower-confidence English-language panel. Successful AIA0001 projects took a little under 23 hours on average, and NorForge estimates a success rate of about 10% across these harnesses. Running Trufflehog over the panel data found hundreds of exposed secrets, 11% verified as valid, and the panels appeared to expose full admin controls; NorForge also found legitimate red-team engagements exposed the same way. NorForge has redacted panel addresses and is working with Reuters to notify victims and with hosts to take panels down. Reuters (19 Oct) independently reviewed the AIA0001 activity and reported that the hacker broke into websites of more than 100 companies, out of more than 1,200 attempted, including Deere, SharkNinja and Cummins: Deere said it took remediation actions and has no indication sensitive information was accessed; SharkNinja said a standalone product-support site was hit and contained; Cummins is investigating a potential attack on a website run by a third-party vendor. Cairn's creator says the platform was never a hacking tool and misuse is a human decision. No Australian victim has been named publicly.
- Product
- Cairn open-source AI agent harness (abused by criminal operators); targets: e-commerce, payment and retail websites (US, Canada, Japan, Australia)
- Versions
- n/a — campaign (AIA0001 activity seen from early October 2026; snapshot to 19 Oct)
- Exploited in Australia?
- unknown
- Patch to
- Australian online retailers and their web agencies: patch and harden storefront platforms (Magento/Adobe Commerce, WooCommerce, Odoo and custom PHP), especially login forms, file-upload and cart custom-option upload paths, PHP deserialisation and exposed session stores such as memcached; hunt web roots and upload folders for small PHP upload forms using move_uploaded_file, new admin accounts and unexpected account-detail changes; watch for long, low-and-slow automated probing from VPS ranges; and rotate any secrets that may have been exposed. If you run AI agent harnesses (Cairn, Strix, Hermes or similar) for red teaming, never expose their panels without authentication, because they hold client targets, findings and credentials.
Primary: NorForge — Inside Cairn: Open windows into massive AI-driven cyber operations (19 Oct 2026) · Vendor: The Verge — A hacker broke into John Deere and SharkNinja with an army of AI agents (19 Oct 2026; Reuters findings, company statements)