- Security firm Norforge found more than 20 exposed control panels for the Cairn AI platform that it judges likely malicious. They show how attackers direct AI agents at websites.
- The open panels also exposed victims' data. Norforge says 11% of the secrets it scanned were confirmed valid.
- Ask vendors and testers where your security data is stored, and review forgotten or vendor-run sites.
The attackers' tools leaked more than they intended
AI agents can now be pointed at websites and left to work. The more useful finding is what happened to the dashboards that control them. Many were open to anyone who looked.
Here is the idea worth keeping. Automation lets an attacker run many break-in attempts at once. It also lets that attacker lose control of the evidence just as fast. A company's risk now depends partly on how carefully others guard their own tools. That includes attackers, penetration testers and vendors.
What Norforge found
Security firm Norforge searched two internet-scanning engines, Shodan and Censys. It was looking for panels running Cairn, an AI platform that coordinates agents toward a goal. It found more than 20 panels it judges likely malicious. All appeared to be driven by money. Norforge saw no obvious state-backed activity.
The largest cluster, which Norforge labels AIA0001, works in Chinese. Norforge counts over 1,100 attack projects across the 14 dashboards it ties to this group. Targets are mostly in the US, Japan and Australia. The apparent aim is lasting access to shop and payment systems that can be cashed in later.
Norforge does not name victims. The Verge, citing Reuters, reports that they included John Deere, SharkNinja and Cummins. The Verge also reports that one hacker broke into more than 100 websites.
How the machinery works
In Cairn, each job is a project. A project has a starting point and an end goal. The agents work in cycles. A fact is something an agent has found. An intent is what it plans to try next. Facts go on a shared board. A human operator can add hints to that board too.
Norforge says the AIA0001 group fed this system through an automated pipeline. Target sites were ranked by traffic. Each was then checked with Playwright, Microsoft's browser automation tool, to confirm that orders could be placed.
A typical task described shops with traffic of 200,000 to 1.5 million. It told the agent to find unauthenticated remote code execution. That means running commands on a server without logging in.
The agents' own labels point to a Claude Code setup running DeepSeek's low-cost 4.1 Flash model. That is Norforge's reading, and it says it is not certain.
Cheap to run, with a success rate near 10%
Norforge assumes a success rate near 10% across the setups it saw. Many other tasks reached partial goals. Some gathered information for later attempts.
For AIA0001 tasks that did reach their goal, the average time was a little under 23 hours. Each produced about 140 facts. The range was wide. At the long end, one project ran for more than five days.
Norforge puts the average cost near $5 per task, failed ones included. Long projects could pass $100. It says the uncertainty is considerable.
Put those figures together. If one task in ten succeeds and each costs about $5, a success costs roughly $50 on average. That is WebPulse's arithmetic on rough estimates, not a Norforge figure. It shows why a low hit rate offers little comfort when attempts are this cheap.
The leak is a second breach
The open panels hold everything the agents discovered. They also hold human input, including credentials harvested elsewhere.
Norforge fed that data into Trufflehog, a tool that hunts for passwords and keys. It turned up hundreds of secrets. Trufflehog confirmed that 11% still worked.
The panels also seemed to expose full admin controls. These include starting, stopping and redirecting projects. Norforge did not test whether the controls work without a login.
Norforge says some apparently legitimate red-team operations were exposed the same way, potentially putting their clients at risk.
Norforge also checked one claimed intrusion at a large hardware parts vendor. The web shell address named in the finished task did serve an uploader shell. The agent's own account was this. It got in through write access to a memcached session store. It then used unsafe PHP object deserialization and old Zend Framework components.
What the companies and Cairn's creator said
John Deere told Reuters it saw "no indication that sensitive information was accessed." Cummins said it is investigating a potential attack on a site run by one of its third-party vendors.
SharkNinja says the incident touched a separate site about product support. It says the threat is now under control. The Verge says none of the three companies had responded to its own request for comment at the time of publication.
Cairn's creator, who goes by @le1xia0, rejected the "hacking tool" label earlier this month. In the creator's words, "misuse is a human decision."
Norforge says it is working to have the malicious panels taken down. Whether that works depends on how hosting providers respond.
Questions to put to your team
Ask every security vendor and penetration tester where your test results and credentials are stored. Ask whether those dashboards sit behind a login. Ask them to search Shodan and Censys for their own tools.
List the smaller sites run by vendors or product teams. The Cummins and SharkNinja statements both point to side sites. Ask who patches them.
Check that session stores such as memcached cannot be written to from outside. Put old PHP components on a retirement plan. Rotate any credential a tester or vendor has handled.
Attackers are now automating the repetitive work of intrusion. Many of these operators were careless with their records. Your defence should not rely on that carelessness.
Produced by the WebPulse Newsroom with AI assistance from the original reporting credited below, and checked against that source by our editorial review. How we use AI.
Original reporting: Norforge.
