NorForge traces AI-agent intrusion campaign through exposed Cairn panels

NorForge said it identified more than 20 publicly exposed Cairn control panels that were likely tied to malicious activity. The largest cluster spanned 14 panels and held more than 1,100 attack projects. According to the company, it mainly targeted organizations in the United States, Japan and Australia, apparently seeking persistent access to e-commerce and payment infrastructure.

NorForge said its researchers confirmed that a URL recorded by one completed task served a live uploader web shell at a large hardware-parts vendor. They also validated a separate case involving a very large US retailer. The checks point to real-world compromise, but they do not verify every Cairn project marked as successful.

Cairn is a general-purpose search engine that divides a goal into tasks for AI workers. A human starts each project by providing an origin and a goal. Workers then create intents, add facts to a shared blackboard and can incorporate further human hints.

The exposed records show operators choosing the targets and objectives, including instructions to seek remote-code-execution paths and install an uploader shell. They do not show the agents independently deciding whom to target or what to accomplish.

Before classifying the panels, NorForge said it excluded empty and access-controlled instances, along with demonstrations and apparently legitimate penetration-testing systems. It assessed the largest cluster, labeled AIA0001 and operating in Chinese, as malicious with high confidence.

Across the observed systems, the researchers estimated an average success rate of about 10%. Successful AIA0001 projects took a little under 23 hours on average, they said. NorForge cautioned that the clusters were not directly comparable and that its data was only a point-in-time snapshot.

The exposed panels posed a separate security risk. NorForge said they appeared to offer full administrative controls, although its researchers did not test those controls without authorization. The company also ran TruffleHog against data exposed through the panels and reported finding hundreds of secrets, 11% of which the scanner verified as valid.