Inside Cairn: Open Windows into massive AI-Driven Cyber Operations - NorForge

Why it matters

NorForge investigated publicly exposed web control panels for Cairn, an AI-powered penetration-testing system that coordinates autonomous agents to probe targets, find weaknesses, and attempt intrusions. The probe followed Gambit Security's September 2026 report on a criminal intrusion campaign against online marketplaces, in which the attacker's staging server showed use of AI harnesses including Cairn, Hermes, and Strix. Using the Shodan and Censys search engines, NorForge found numerous exposed panels; after filtering out legitimate red-team operations, more than twenty were assessed as likely malicious, all apparently financially motivated. The panels leak highly sensitive details about targets, including discovered weaknesses, account secrets, and API keys, so NorForge withheld addresses and redacted extracted data. The most active cluster, designated AIA0001, operated in Chinese across fourteen panels hosted via Cgi Global Limited, running a large volume of attack projects against organizations mainly in the United States, Japan, and Australia, seeking persistent access to e-commerce and payment infrastructure. Exposed legitimate red-team panels also risked their clients' security.