Skip to content
Neural Daily

PolicyNews

AI agents breached 100+ sites via open Cairn panels

On October 19 NorForge published its investigation of exposed control panels for Cairn, an AI harness. It flags more than 20 panels as likely malicious. The largest Chinese-language cluster ran over 1,100 attack projects. Reuters and The Verge report victims including John Deere, SharkNinja and Cummins.

By: Mikola Máté Patrik · · 2 min read

NorForge infographic on AI-driven intrusion campaigns: projects, outcomes and outcome types for clusters AIA0001, AIA0002 and AIA0003
Image: NorForge · Press kit · Official infographic from the NorForge report · Source

What Cairn is and why it was visible

Cairn is a state-based problem-solving engine. Projects move from an origin toward a goal through intents and facts on a shared blackboard. Used for pentesting, it can take a target and an end state, then coordinate agents to find weaknesses and break in. NorForge found open panels via Shodan and Censys. Beside apparently legitimate red-team panels, more than 20 looked malicious (NorForge).

AIA0001: the largest cluster

Fourteen panels, Chinese language, hosted on AS56594, high confidence. More than 1,100 projects, mostly targeting the US, Japan and Australia, aimed at e-commerce and payment infrastructure. A typical task seeks unauthenticated RCE and lands an uploader webshell. Successful projects averaged under 23 hours to goal, with about 140 facts each. NorForge estimates roughly 10% average success.

Workers were named claudecode_deepseek-v4.1-flash. NorForge reads that as a Claude Code harness calling DeepSeek V4.1 Flash. Token cost is only estimated: about $5 per average task, over $100 for long ones. Reuters put the full campaign near $5,000, or about $50 per successful breach.

What the companies said

According to The Verge, a John Deere spokesperson told Reuters there was no indication sensitive information was accessed. SharkNinja said a standalone product-support site was hit and contained. Cummins is investigating a possible attack on a third-party vendor site (The Verge).

What defenders should take away

The panels exposed not only targets and exploit chains but also hundreds of secrets; Trufflehog verified 11% as valid. NorForge is notifying victims with Reuters and working on takedowns. Cairn's creator says the platform was never a hacking tool and that misuse is a human decision. In practice, agentic intrusion costs are already in reach for low-budget actors.

    Produced with the help of AI, reviewed by an editor. How we make our articles

    Reviewed and edited by the Neural Daily desk. About

    Related articles