Exposed Cairn Panels Show Criminals Running AI Intrusions at About $5 a Task

Security firm NorForge found more than 20 publicly reachable control panels for Cairn, an AI system that coordinates agents to break into a target, and says they appear to belong to criminal operators. The Oct. 19 post is by an author named Snorre. NorForge says it is notifying victims, working with Reuters, and trying to get the panels taken down.

Cairn takes a target and an objective, then loops through facts (what an agent found) and intents (what it will try next) on a shared blackboard that every agent worker can read. A human operator can add hints to the same board. One project graph in the post ends at "GOAL MET: Webshell injected into the site."

What the exposed panels show

NorForge says the panels appear to have no access controls and seem to expose administrative functions such as starting and stopping projects and redirecting agents. It did not test whether those controls work without authorisation. Trufflehog scans of the exposed data turned up hundreds of secrets, 11 percent of them verified as valid. Some of the exposed panels are legitimate red-team engagements, which NorForge calls a risk to those clients.

The post groups the malicious panels into three clusters.

Cluster	Panels	Confidence	Focus
AIA0001 (Chinese-language)	14	High	1,100+ projects; payment infrastructure, mainly U.S., Japan, Australia
AIA0002 (English)	10	High	Card and crypto theft; some targets in Africa
AIA0003 (English)	1	Low	59 projects; smaller e-commerce sites and large U.S. platforms

Source: NorForge, Oct. 19, 2026.

The post does not say who built Cairn or under what licence it is distributed. It says the agent environment looks repurposed from an earlier capture-the-flag setup and that it has no evidence Tencent was involved.

What a task costs, according to two sets of figures

NorForge puts average success at about 10 percent of tasks reaching the goal, with many more reaching partial goals. AIA0001 projects that did reach the goal took a little under 23 hours and about 140 facts on average, and the average cost across all tasks, failures included, was about $5. Projects with more than 1,000 intents and facts could pass $100, and the authors say the uncertainty is considerable.

Gambit Security's report, as relayed by BleepingComputer, covers a campaign that used three tools: Strix for scanning, Cairn for exploitation and Hermes for orchestration. Gambit counted 105 attack waves between Sept. 10 and 15 with at least 27 companies compromised to varying degrees, more than 600,000 card records taken from two of them and skimmers on five more organisations. It puts total spend at $12,000 to $18,000.

1. Cheapest target3.13 $
2. Mean25.46 $
3. Most expensive target79.31 $

Source: Gambit Security, via BleepingComputer, accessed 2026-10-20

The two figures do not match. NorForge's $5 is an average over every task including failures; Gambit's $25.46 is a mean over completed scans from one operator. The Terminal cannot say whether the two datasets cover the same operator, and neither source claims they do. BleepingComputer adds that this Cairn is not the AI malware analysis tool of the same name released by Cisco Talos.

What defenders can check

Gambit lists how the skimmers were planted: code appended to legitimate JavaScript files, script tags added to checkout pages or Google tag blocks, poisoned S3 and CDN content and server-side caches, edited database fields, altered Kubernetes deployments, and cron jobs that restore a skimmer after removal. A clean-up that skips the cron jobs does not hold.

Gambit also found a Hermes skill file telling the agent to "wipe the source fields in batches" in Magento databases after copying card data. That caused outages and lost data at several retailers, so incident plans should assume the data may be gone.

NorForge saw a worker named claudecode_deepseek-v4.1-flash, which it says may be a Claude Code harness running a DeepSeek model but could not confirm; the Terminal's piece on DeepSeek V4.1 Flash covers that model. NorForge also found a live webshell on a hardware parts vendor's site, reached through a memcached write and PHP deserialization; an earlier Terminal story covers webshells planted after an incomplete patch. NorForge has not said when the panels will come down.