Open Cairn Panels Exposed a Hacker’s AI Agents, Which Reuters Says Breached 100+ Sites, and Cairn’s Server Has No Login

NorForge, a company that describes itself as bringing “extensive sandboxing expertise to AI agents,” published a report on Monday, October 19 about Cairn, an open-source harness that coordinates AI agents to probe a target and break in, and about the more than 20 exposed Cairn control panels that it judges likely malicious. Reuters, which saw the report before it went out, says one Chinese-speaking operator’s agents broke into more than 100 websites, and it names Deere, SharkNinja and Cummins among the victims. The report itself names no victim, and the headline figures come from Reuters rather than from the report text we read.

Three details in the primary material change how the coverage reads. The panels were open to anyone who found them because Cairn’s server has no login: the code on its main branch contains none, and a request for web page authentication has been open since May 21. The worker label that coverage reads as Claude Code driving a DeepSeek model has the same shape as the worker in Cairn’s own example configuration, which points the Claude Code command line tool at DeepSeek. And the Tencent competition file NorForge found in an agent’s workspace is part of Cairn’s public worker container. Details here are as of 19:22 UTC on October 19, and the last section lists what we could not check.

What NorForge found

The report, by Snorre Fagerland, whom Quartz and TNW identify as NorForge’s principal threat researcher, starts from Gambit Security’s September report, which found three AI harnesses (Hermes, Strix and Cairn) on a recovered attacker server. Such tools often have web interfaces, so NorForge searched Shodan and Censys for them. “Most need authorization to access. Most.” NorForge says that “one of the most neglected platforms is Cairn.”

In Cairn, each task is a project with an origin and a goal. Agent workers post what they find (facts) and what they plan to try next (intents) to a shared board, and a human operator can add hints to it. NorForge found more than 20 panels it judges likely malicious. All of them appeared to have a financial motive, with “no obvious state-sponsored intrusion activity,” and it also found a “considerable number” of apparently legitimate red team operations exposed the same way, “potentially placing clients at risk.” It sorts the malicious ones into three clusters.

AIA0001 is where the numbers come from. The task text NorForge reproduces tells the agent that the target is a confirmed real shopping site in four countries (the US, Canada, Japan and Australia) with traffic of 200,000 to 1.5 million, that Playwright has verified an order can be placed, and that the goal is unauthenticated code execution, with login SQL injection, unauthenticated endpoints, file uploads, deserialization, authentication bypass and account takeover as priorities. The payload it asks for is an uploader shell, a page with an HTML upload form that saves files with move_uploaded_file, “explicitly not a command-executing webshell.” NorForge says the task feed is automated: sites are ranked by traffic and tested with Playwright before they reach Cairn.

On outcomes, NorForge calls it a reasonable assumption that the average success rate for the harnesses it saw hovers around 10 percent, with many of the rest reaching partial goals, while noting that the clusters have different goals and are not directly comparable. For AIA0001 projects that did reach their goal, the average time from start to goal was a little under 23 hours, with 140 facts per project, and one project ran for more than five days. It puts the average cost of a task at about $5 including failed and early-ending projects, says projects with more than 1,000 intents and facts could cost more than $100, and warns that “numbers could be off by a clear margin.” It also reports one check of its own: it fetched the shell address from a completed task against a large hardware parts vendor, and the address served a live uploader webshell. For the sixth of its case studies, a very large US retailer, it says the compromise chain “was validated by us.” The six case studies run from an Australian online store and a restaurant point-of-sale system to US and Japanese retailers.

Where the headline numbers come from

The figures in the coverage come from different places and measure different things.

The victims’ statements are narrower than the headline. Deere told Reuters it had taken remediation steps and had no sign that anyone accessed sensitive information. SharkNinja said the attack hit a standalone product support site and that it had contained the threat. Cummins told The Verge that it “is investigating the report of a potential cyber-attack on a website operated by one of our third-party vendors.” TNW adds that “Reuters could not establish how much data, if any, the hackers took.”

Why the panels were open: Cairn’s server has no login

NorForge says the panels it saw “appear completely unprotected, exposing what looks like the full administrative functionality of the harness,” including controls for starting and stopping projects, inserting data and redirecting agents. It did not test whether those controls work without authorization, “for reasons that should be fairly obvious,” and neither did we: we touched no panel. What we could check is the project’s own repository, and it explains much of the finding. NorForge’s conclusion is that “the attackers are not well prepared for this technology either.” Part of that, on our reading, is a default in the project’s own files.

• What Cairn is. Its README calls it “a general-purpose problem-solving engine” validated first on autonomous penetration testing. It reports solving all 54 problems in the Tencent Cloud Hackathon’s AI Penetration Testing Challenge (2nd Edition) and finishing third among 610 teams, and it supports Claude Code, Codex and Pi as workers. The repository was created on April 19, 2026, and showed about 3,700 stars and 633 forks when we looked. The latest commit on its main branch is from September 7 and the latest release, v0.2.1, from May 10.
• How the server is started. The command cairn serve binds to 127.0.0.1 by default, but the Docker Compose file the README recommends starts it with --host 0.0.0.0 and publishes port 8000, the port in NorForge’s panel list.
• What the server checks. We read the server code on the main branch: the FastAPI app, its five routers, the data models, the database module and the services file. None of it checks credentials, and the bundled web page contains none of the words login, password, token or authorization. The README does not mention authentication or exposure. It carries a disclaimer that Cairn “is intended to be used only in environments where you have explicit authorization to operate.”
• What was asked for. Issue 8, opened on May 21, begins with a suggestion to add a web page authentication feature (our translation of the Chinese title). It is open, with no comments, 151 days later. A contributor’s pull request that added login (JWT and bcrypt) and a React front end was merged on June 30, but into a branch named dev-0.3.0 rather than main, and its description says the existing project and intent APIs “remain unauthenticated” and that “Full API authentication is deferred to the v1.0 gRPC rewrite.”
• What the author says. The Verge quotes Cairn’s author, who posts as le1xia0, saying that “misuse is a human decision, not a feature of the engine.” TNW, relaying Reuters, quotes the author on X: “If it is used to carry out harmful hacking attacks, that is not my intention.”

Read together, the project relies on a README disclaimer for authorized use and has no access control in its server, and its shipped Compose file publishes that server on every interface. Whoever can reach port 8000 can use the panel, which is also how legitimate red team operations ended up exposed the same way. A reverse proxy or VPN could add a login, and some deployments may have one. We read the code and the repository’s records, not the panels.

What the Claude Code label does and does not show

NorForge says every AIA0001 task ran under a worker named claudecode_deepseek-v4.1-flash, which “could mean a Claude Code harness using the Chinese DeepSeek 4.1 Flash model.” TNW and AI Weekly pass that on as Anthropic’s Claude Code calling DeepSeek’s model. Cairn’s own files explain the label. The dispatch.example.yaml that the README tells users to copy defines one active worker, named claudecode_deepseek-v4-pro, of type claudecode, with ANTHROPIC_MODEL set to deepseek-v4-pro and ANTHROPIC_BASE_URL set to https://api.deepseek.com/anthropic. The name is a free-text field that only has to be unique, and the adapter starts the Claude Code command line tool with its permission prompts switched off (--dangerously-skip-permissions). So the AIA0001 label has the shape of the example worker with another model name: Claude Code is the agent shell, and the model behind it is whatever the base URL points to.

Gambit’s report points the same way. It says that “DeepSeek v4.1 Flash was used in the Cairn attacks,” and the only Anthropic model it names is Opus 4.6 in the separate Hermes console, used “after newer models refused its requests.” Computing reported that Anthropic said it had identified and banned the account linked to Gambit’s case. None of the coverage we read of NorForge’s report includes a response from Anthropic or DeepSeek, and the label is still only what an operator typed. NorForge itself says it “could mean” what it reads. The AIA0002 workers, pi_openrouter_deepseek, read as the Pi coding agent using DeepSeek models through OpenRouter.

The Tencent file in the agent’s workspace

One agent task update that NorForge reproduces describes a Kali container “belonging to the tsec CTF/intelligent penetration test competition framework,” a skill file at /home/kali/workspace/.claude/skills/tsec-actions/SKILL.md, an empty TSEC_SERVER_HOST variable and a TSEC_AGENT_TOKEN that was never injected. NorForge reads this as a setup repurposed from a Tencent capture-the-flag configuration and adds that “there is no reason to believe that Tencent had anything to do with this operation.”

Cairn’s repository explains the file more simply. Its worker container (container/Dockerfile, built into the public ghcr.io/oritera/cairn-worker-container:latest image by a workflow that runs on changes under container/) starts from kalilinux/kali-rolling and copies container/.agents to both /home/kali/workspace/.agents and /home/kali/workspace/.claude. That folder holds skills/tsec-actions/SKILL.md, a Chinese-language note telling the agent to submit flags with those two environment variables, which the example dispatcher configuration sets to placeholders. An operator running the stock image should therefore show the same leftovers NorForge saw. That fits NorForge’s conclusion about Tencent, and the README’s own link to the hackathon where the project placed third shows where the file came from.

What store operators can check

• Uploader shells. The task text asks for a page with an upload form that saves files with move_uploaded_file, not a command shell. A search of web roots and upload directories for PHP files containing that call outside your own upload handlers, and for new files in web-writable directories, is a place to start. That is our reading of the task text, not a NorForge instruction.
• The priority list. Login SQL injection, unauthenticated endpoints, file uploads, deserialization, authentication bypass and account takeover are the surfaces the AIA0001 task names first.
• Adobe Commerce and Magento. NorForge’s inventory of one agent’s working folder lists a proof of concept and a Docker validation lab for CVE-2026-75650. NVD describes it as an improper neutralization of special elements in a template engine in Adobe Commerce, scored 10.0 by Adobe. CISA added it to its Known Exploited Vulnerabilities catalog on September 8 with a September 11 deadline, and Adobe’s bulletin APSB26-146 is the vendor advisory NVD links. It blocked our automated fetch, so we could not read its fixed versions. The inventory shows what the agent had on disk. The report does not say any victim was reached through that flaw.
• Staging servers. NorForge lists two AIA0002 staging servers, 199.247.25[.]25 and 199.247.27[.]2. The AIA0001 panel addresses are redacted, and NorForge says it will share the unredacted list with bona fide security researchers who contact it.
• Your own harness. If you run an AI testing harness for authorized work, keep its panel off the internet. NorForge says that “placing real customer penetration tests on an unsecured panel is highly problematic,” and that “having your site tested on an open Cairn instance is often a serious security issue, regardless of outcome of the test.”

How this compares with Gambit’s September report

Gambit’s report, published September 22, describes a financially motivated operator whose staging server it recovered. Between September 10 and 15 the operator launched 105 Cairn projects. Gambit says at least 27 companies were compromised to varying degrees, at least 600,000 unexpired card details were taken from two of them, and skimmer scripts went onto the sites of five. It reports that the operator’s own cost review gives a mean of $25.46 per completed scan (from $3.13 to $79.31), and says that where access was achieved it “usually took less than a day.”

Neither report links its operator to the other’s. They share a tool, a model name (DeepSeek V4.1 Flash in Gambit’s account of Cairn and in NorForge’s worker label) and operators who wrote their instructions in Chinese, but NorForge’s report describes persistent access through uploader shells and does not mention skimmers. Neither is Cisco Talos’s CAIRN framework, which we covered in September. BleepingComputer’s write-up of Gambit made the same point, saying the tool “should not be confused with the same-name AI malware analysis tool Cisco Talos released yesterday.”

What we do not know

• The victims. The report names none. Reuters identified them by reviewing the operator’s activity, and the 100-plus count is Reuters’s reporting of Fagerland’s count. We could not read the Reuters article, which returns an error to automated requests, so we relied on TNW, The Verge, Quartz and AI Weekly, which summarize it.
• What “broken into” covers. The count may include projects whose panel status says the goal was met. NorForge’s own checks, one live shell and one validated chain, cover a small part of it.
• The data taken. Reuters could not establish how much, if any.
• The fix. Issue 8 is still open, and the author’s public comments, as quoted by The Verge and TNW, do not address authentication.
• Responses. We saw none from Anthropic or DeepSeek on this report, and none from the hosting providers; the Cairn author’s comments are quoted above. NorForge says takedowns of the panels depend on how well the hosting providers respond.

Agent harnesses keep turning up in attack reports. In the four weeks since Gambit’s report we covered Carbonato’s Docker botnet, which ran on the Hermes Agent framework, and the Korean case where exposed Claude Code logs tied an AI pentest agent to data leaks at financial firms, and in July Hunt.io caught the Hermes agent running unattended in a Thai Finance Ministry breach. What is new here is that the harness’s own server is the exposure.

Sources and method. We read NorForge’s report and Gambit’s report in full; coverage in The Verge, TNW, Quartz, AI Weekly, BleepingComputer and Computing; and the Cairn repository: the README, Compose file, example dispatcher configuration, worker container Dockerfile, skill file, image build workflow, issue 8 and pull request 24. For the Magento flaw we used NVD’s record and CISA’s Known Exploited Vulnerabilities catalog through its raw JSON feed, and Adobe’s bulletin is linked from both. TNW’s one-line summary of Gambit says the cards came from 25 companies, while Gambit’s report says two, and we use Gambit’s. The repository facts are from the main branch as of 19:22 UTC on October 19. We did not install or run Cairn, did not touch any panel or victim site, and did not test any command or indicator.