Twenty-plus exposed Cairn panels show AI-directed intrusion work. A project is not a victim

What the researchers could actually see

The 19 October NorForge investigation describes Cairn as a state-based agent framework. An operator sets an origin and goal. Agent workers gather facts, propose intents, share them on a project blackboard and act through tools. Exposed web panels gave researchers access to task descriptions, progress records and in some cases sensitive material from targets. They also found exposed panels used by apparently legitimate red teams, a separate confidentiality concern for clients.

NorForge grouped malicious-looking activity by shared panel evidence, language, hosting and task patterns. Its AIA0001 cluster has 14 panels and more than 1,100 projects. The name is an activity cluster, not a named criminal group, employer or state sponsor. The researchers say they saw no obvious state-sponsored activity in the exposed panels. Chinese-language tasks or hosting choices do not establish nationality. The team's article explicitly rejects any inference that Tencent ran the operation merely because a worker environment appeared to contain a reused competition configuration.

The other clusters have different aims and weaker or different evidence. NorForge links 10 panels to AIA0002, which it assesses with high confidence as financially motivated; its task text refers to payment cards, cryptocurrency and attacker-controlled collection hosts. Some of those panel links are less certain than others, and several panels had gone dark during the investigation. AIA0003 is one panel with 59 projects and a low-confidence malicious assessment. Adding 14, 10 and one produces 25 panels in the three described clusters, but those are research classifications at a snapshot in time, not a census of every Cairn deployment. It would be especially misleading to combine their project outcomes into one measured success rate.

a scope comparison, not a success-rate bar chart. Panels, projects and victims have different denominators. Source: NorForge, 19 October 2026.

More than 20

• Unit and scope: Exposed Cairn panels assessed by NorForge as likely malicious.
• What it cannot mean: Twenty attackers or twenty confirmed victims.

14

• Unit and scope: Panels linked by NorForge to cluster AIA0001.
• What it cannot mean: Fourteen independent operators.

More than 1,100

• Unit and scope: Projects visible across those 14 AIA0001 dashboards.
• What it cannot mean: More than 1,100 successful intrusions.

Around 10%

• Unit and scope: Researcher's rough success-rate assumption across observed harnesses, with goals and targets that differ.
• What it cannot mean: A measured population-wide compromise rate.

Under 23 hours; 140 facts

• Unit and scope: NorForge's averages for AIA0001 projects that reached their stated goal.
• What it cannot mean: Average time or activity for all started projects.

Why the panel count is only the start

NorForge found panels through internet-facing interface discovery, then grouped some by task wording, target-selection patterns and hosting. That is stronger than treating every Cairn banner as malicious, but the view is still opportunistic: protected panels, panels that disappeared and operators using other infrastructure are outside this snapshot. The report does not give a population denominator for all Cairn users. AIA0001, AIA0002 and AIA0003 are analytical labels attached to observed activity. They are not organisations that NorForge identified through registration records or payment trails.

AIA0001's task feeder is unusually specific. The translated instruction says targets in the US, Canada, Japan and Australia had already been checked as real shopping sites with traffic between 200,000 and 1.5 million, and that Playwright had verified an order flow. The panel then directed the agent to pursue unauthenticated code execution and leave an uploader. That detail shows a division of labour: an upstream pipeline filters and prioritises sites, while the agent works from an origin towards an operator-defined goal. The report also noticed a recurrent dropped initial “w” in hostnames across panels, which it treats as a possible shared buggy normaliser. That is a clustering clue, not proof of one legal entity or geography.

AIA0002 differs: its English-language tasking mentions cards, cryptocurrency and collection hosts, and the researchers saw staging access details in the panel. They did not log in to those backends. AIA0003's authorisation language changes over the course of its projects, which is why NorForge's malicious assessment is lower confidence. Combining all three into one “AI hacker group” would erase material differences in intent and evidence.

The observed technique, with its evidence boundary

One AIA0001 task described selecting real commerce sites in four countries, ranking them by traffic and verifying purchase flows with Playwright before passing targets to Cairn. The task sought unauthenticated command execution through routes including unsafe file upload, deserialisation, SQL injection leading to execution, server-side template injection or server-side request forgery. Those are operator objectives and possible routes listed in the task, not a finding that every target was vulnerable to each technique.

The control sequence NorForge documents is target-selection pipeline → operator goal → Cairn facts and intents → agent worker tools → reported result. The trust boundary sits at the target website. The operator goal and the worker's tool use are directly visible in a panel; the result still requires independent validation. In one example, NorForge fetched the claimed shell URL and says it served an uploader web shell on a hardware-parts vendor site. The researchers describe the apparent route as write access to a memcached session store, unsafe PHP object deserialisation and a legacy Zend Framework gadget chain, based on the agent's account. That route is specific to this case and should not be drawn as the common Cairn attack path. The researchers also say they validated a separate compromise involving a vulnerable backend selected by a cookie setting.

The researchers saw a worker environment containing Playwright and Chromium for browser testing, plus reconnaissance, scanning and PHP testing utilities. That inventory supports the view that workers could combine ordinary security tools with model-directed planning. It does not prove that each listed tool was run against every target. NorForge saw the worker name claudecode_deepseek-v4.1-flash in one cluster and says it could indicate a Claude Code harness using a DeepSeek model. A worker label is not independent proof of the underlying model or its operator. Similarly, the paper estimates about $5 per task only from inferred token economics; it says the uncertainty is considerable and some longer tasks may cost far more. That estimate should not be reported as an attacker invoice.

The persistence objective is unusually explicit. AIA0001 task instructions sought an uploader rather than an immediately command-executing web shell, leaving an access route for later action. The distinction matters for response: a current web application may appear functional while an unauthorised upload endpoint or server-side file persists. It is still wrong to infer that every project planted a shell.

A claim of success is not the same as a verified intrusion

Cairn's own project state can say “GOAL MET”. That is an internal result in an attacker-controlled panel, and the requested goals differ across projects. NorForge did more than quote that field in selected cases: it says it fetched a named uploader URL on a hardware-parts vendor site and saw the file served, and separately validated a very large retailer compromise where a cookie setting selected a vulnerable backend. Its case-study section also describes an Australian commerce site with command execution and other retailer and POS cases. These are case checks reported by the researchers, not a victim-by-victim audit of all 1,100-plus AIA0001 projects. NorForge does not publish the unredacted list because the panels contain sensitive target material and some remain online.

The numbers must retain their own denominators. “About 10%” is the researchers' rough judgement across harnesses with mixed task goals, not a sampled measured rate with confidence intervals. The under-23-hour mean and 140 facts per project apply only to AIA0001 projects that reached their goal in the snapshot, not to failed or unfinished attempts. At least one project ran for more than five days. The worker's guessed API spend of about $5 per task is a speculative token-cost model, not observed invoices, and the report itself says longer tasks could cost far more. A defender should not use those figures to forecast compromise probability or attacker economics without independent telemetry.

The second exposure: the operators published their own working data

An unsecured panel may reveal target names, vulnerability notes, credentials, API keys and progress records to anyone who finds it. NorForge says it ran TruffleHog across panel data, found hundreds of secrets and verified 11% as valid. The denominator for that percentage is the secrets it scanned, not all victim credentials or all projects. It has withheld unredacted panel addresses while working with Reuters to notify apparent victims. NorForge says the interfaces appeared to expose administration controls, but it did not test unauthorised use of those controls. That makes this a two-sided security failure: the agent system can direct intrusions, and the poorly secured control plane can expose both attacker activity and target material. The public article does not provide a complete affected-organisation list, a notification timeline for every target, or a verified number of compromised sites.

This reporting is distinct from the earlier Gambit-linked AI card-skimming account. NorForge says that work prompted its search, but its newly exposed panels and case checks are the evidence here. It is also distinct from the unrelated CAIRN name used for other tooling.

For defenders running commerce infrastructure, the useful checks follow the observed mechanisms: review unexpected uploads and executable files in web-accessible directories, unexpected writes to session stores, deserialisation paths in older PHP components, administrative access and anomalous outbound connections. Preserve logs before cleaning a suspected shell. For teams conducting authorised agent-led testing, restrict the control panel, protect client secrets, and establish retention and access controls before allowing agents to collect them. None of these checks implies a particular organisation is in NorForge's set.

For incident responders, the exposed-panel finding creates two possible reasons to investigate. An organisation may have been targeted by an agent, or its secrets and vulnerability notes may have been exposed through someone else's unsecured assessment panel even if an intrusion failed. If contacted by NorForge or another reporter, first authenticate the notification channel, preserve panel references and relevant logs, and scope the specific claim. Check file-integrity and web access for the uploader path in a reported case, and rotate only secrets shown or plausibly exposed after validating their scope. Do not run public indicators blindly against unrelated hosts; the paper redacts many live panel addresses for a reason.

For operators of authorised red-team infrastructure, the simplest control question is whether an unauthenticated internet visitor could read projects, credentials or client targets or reach project controls. Lock down the panel, separate tenant and client data, minimise stored secrets, and test access control from outside the corporate network. NorForge says it did not exercise the apparent administrative controls, so no one should present unauthorised takeover of those panels as independently demonstrated.

The next evidence that could tighten the count is a victim-by-victim validation record, dates for individual access and containment, and confirmation from affected operators. Until then, keep panels, projects, claimed goal completions and validated intrusions separate.

Sources checked 20 October 2026: NorForge, Inside Cairn; earlier P.K. Sharma AI card-skimming coverage for topic distinction.