The hackers who broke into more than 100 companies left their own control panels open to anyone who knew where to look. NorForge, the AI security firm that uncovered the Cairn hacking campaigns, found them by scanning the public internet for unprotected AI harness dashboards, and what those dashboards contained is the second half of the story: targets, weaknesses, credentials, and the controls to run the attacks themselves.
Last week we covered what the campaign cost: about $5,000 in model tokens for more than 100 breached companies, in our report on the $50 break-in. This is what the other side of that investigation found, and it is arguably more alarming than the breaches. The attackers were not just careless about their victims. They were careless about themselves, and their carelessness widened the damage in ways no single breach could.
How the hunters found the hunters
NorForge started from a September 2026 report by Gambit Security, which had recovered an attacker's staging server and found AI harnesses such as Hermes, Strix, and Cairn in use. Those harnesses often have web-based control panels, and NorForge reasoned that some would be left unsecured on the open web. Searches on the internet-scanning platforms Shodan and Censys confirmed it. Most panels required authorization. Some did not, and Cairn panels were the most neglected of all.
The exposed panels gave NorForge an unusually complete view of the operations: how threat actors pick targets, brief their agents, exploit weaknesses, and keep access afterward. The panels also leaked the attackers' own tradecraft. One fingerprint was almost comic: a buggy domain normalizer stripped a leading "w" too aggressively, turning "wholesale" into "holesale" and "winter" into "inter" across many target lists, which made related panels easy to link. Another came from a briefly exposed agent worker folder, which showed a Kali container repurposed from a Tencent CTF competition configuration. NorForge is explicit that there is no reason to believe Tencent had anything to do with the operation; the criminals were reusing available tooling.
The target pipeline was industrial, not artisanal. Sites were ranked by traffic (200,000 to 1.5 million visitors), verified with Microsoft's Playwright browser automation to confirm that orders could actually be placed, and then fed to Cairn with terse objectives: find unauthenticated remote code execution, preferring login SQL injection, unauthenticated endpoints, file uploads, deserialization, authentication bypass, and account takeover.
Three clusters, 25 panels
NorForge grouped the malicious panels into three clusters, all assessed as financially motivated, with no obvious state-sponsored activity observed.
| Cluster | Panels | Projects | Profile |
|---|---|---|---|
| AIA0001 | 14 | 1,100-plus | Chinese-language; e-commerce and payment targets in the US, Japan, and Australia; hosted via AS56594 |
| AIA0002 | 10 | Not disclosed | English-language; card and cryptocurrency theft; merchant payment and gray-market targets; hosted via AS20473 |
| AIA0003 | 1 | 59 | English-language; mix of small e-commerce and very large US platforms; assessed malicious with low confidence |
The clusters differ in focus, and NorForge warns they are not directly comparable. AIA0001 is the most complete picture of general-purpose intrusion: an agent worker named for a Claude Code harness running DeepSeek's model, tasks that end with a webshell installed, and an average of under 23 hours from project start to goal, generating about 140 recorded facts per project. One project ran for more than five days. AIA0002 is blunter: task briefs that say little more than "fetch credit cards" or "fetch crypto," with SSH logins to backend staging hosts exposed inside the taskings themselves. AIA0003 looks exploratory, its projects drifting from claimed authorized assessments toward explicit demands for shell, admin, and database access.
Across the harnesses NorForge observed, the average success rate sits around 10 percent, with many remaining tasks reaching partial goals or gathering information usable in later attempts. Ten percent sounds low until it is priced: at roughly $5 per task on NorForge's estimate, a 10 percent hit rate still buys a breach for about $50.
What the panels leaked
An exposed Cairn panel is not a status page. It is the operation. Panels detail every target, every weakness the agents found, and whether a compromise succeeded. They also include human input that contains credentials harvested elsewhere. NorForge ran the secrets scanner Trufflehog over the panel data and found literally hundreds of secrets of different kinds, from trivial to extremely serious, with 11 percent verified valid by the scanner.
Worse, the panels appear to expose the harness's full administrative functionality: controls for starting and stopping projects, interfering with ongoing operations, inserting new data, redirecting agents to different targets, and restarting old projects. NorForge did not test whether those controls work without authorization, for reasons it calls obvious, but the implication stands on its own. These are autonomous offensive agents with considerable capability, potentially steerable by anyone who stumbles across their panels. As NorForge puts it, tokens could evaporate like dry ice on a hot plate.
The intrusions themselves were real, not claimed. NorForge verified one directly: a completed task's shell URL, fetched against a large hardware parts vendor, served a live uploader webshell. The agent's own explanation credited unauthorized write access to a memcached session store, combined with unsafe PHP object deserialization and an exploitable gadget chain in legacy Zend Framework components. Case studies in the report run from an Australian e-commerce site with full command execution to a restaurant point-of-sale compromise and a very large US retailer breached through a single cookie setting that selected the vulnerable backend server.
The red-team problem
Not every exposed panel belonged to a criminal. NorForge found a considerable number of apparently legitimate red-team operations exposed the same way, and it declined to name them. The point is not mercy. It is that placing real customer penetration tests on an unsecured panel is a nightmare scenario: secrets gathered from a client, published to the internet, alongside the client's own weaknesses.
The symmetry is the story's sharpest edge. The same rush that made attackers effective made them sloppy, and the same sloppiness afflicts the defenders-for-hire. Everybody building on agent harnesses is learning the same lesson at the same time: the control plane is now part of the attack surface, and it is often the softest part.
What to close first
The practical checklist writes itself from the report. Inventory every internet-facing AI harness, agent dashboard, and automation panel in your estate, including the ones a contractor set up. Put them behind authentication and network restrictions, never on the open web by default. Treat agent control planes as critical infrastructure, with the same secrets hygiene as production credentials, because that is what they now contain. And monitor for agent-shaped probing: long sessions, systematic endpoint enumeration, and repeated deserialization and upload attempts are the signature NorForge documented.
The other side of the same problem is playing out in public: sites are increasingly answering agent traffic by shutting it out entirely, a shift we tracked in our survey of the great agent lockout. Blocking agents and securing agent dashboards are two halves of one realization. The agent era did not just give attackers a new tool. It gave everyone a new thing to protect, and the first people to learn that lesson were the attackers themselves, the hard way, in public.
By ByteHerald Staff. NorForge published its Inside Cairn investigation in October 2026, documenting 25 exposed panels across three clusters, a 10 percent average success rate, and hundreds of exposed secrets with 11 percent verified valid. Reuters reported on October 19, 2026 that a Chinese-speaking hacker's AI agents attempted more than 1,200 sites and broke into more than 100 companies, including Deere, SharkNinja, and Cummins, for roughly $5,000 in tokens. Gambit Security reported in September 2026 on AI harnesses found on a recovered attacker staging server.
Comments
Post a Comment