On October 19, 2026, Snorre of the security firm NorForge published “Inside Cairn,” an investigation of publicly exposed control panels for AI-driven penetration-testing harnesses. The work started from a September 2026 Gambit Security report on a criminal campaign against online marketplaces that named the harnesses Hermes, Strix and Cairn. Using Shodan, Censys and ongoing scans, NorForge found Cairn panels that were reachable on the internet, excluded ones that were empty, protected or looked like legitimate red-team work, and attributed the rest to three clusters.
Cairn runs each task as a project with a goal, posting cycles of “facts” (discoveries) and “intents” (planned actions) to a shared blackboard that human operators can also add hints to. The largest cluster, AIA0001, is Chinese-language, spans 14 panels and more than 1,100 attack projects, and mostly targeted e-commerce and payment infrastructure in the US, Japan and Australia, apparently to gain persistent access for later monetization. Its workers were labeled claudecode_deepseek-v4.1-flash, which NorForge reads as a Claude Code harness driving DeepSeek 4.1 Flash. A second English-language cluster, AIA0002 (10 panels), focused on financial theft, labeled its workers pi_openrouter_deepseek and also used Cairn to move funds between crypto wallets; a third, AIA0003, had one panel and 59 projects. Targets were fed in automatically, ranked by traffic and pre-validated with Playwright, and the typical goal was unauthenticated remote code execution with an uploader shell as payload. One documented intrusion combined write access to a memcached session store, unsafe PHP deserialization and a legacy Zend Framework gadget chain.
NorForge estimates an average task cost of around 5 dollars including failed runs, more than 100 dollars for long projects, and an average success rate of about 10 percent, with successful AIA0001 projects taking a little under 23 hours and about 140 facts each. It independently confirmed one claimed intrusion at a large hardware parts vendor by finding a live uploader webshell, and running Trufflehog over the exposed data found hundreds of secrets, 11 percent verified valid. Panel addresses are redacted because many remain live; NorForge says it is working with Reuters to notify victims and trying to get the panels taken down.
Why it matters: it is a rare look inside criminal agentic operations at scale rather than a lab demonstration, showing cheap off-the-shelf models in commodity agent harnesses grinding through ranked target lists with little human input - and the attackers’ own tooling leaking their operation because the dashboards were left open.
What it does not show: NorForge does not publish a total count of successful intrusions or name victims; the costs are rough estimates by its own account; and the model attribution rests on worker labels, not confirmed provider records. The exploit techniques it documents were conventional, long-known bug classes.