The Pulse
Attackers Hijack at Least 17 Exposed Cairn AI Harnesses
Attackers inserted malicious tasks into at least 17 exposed Cairn panels, directing AI agents to target the systems running them. NorForge describes the campaigns as scripted, with evidence of possible human intervention but no conclusive p
AI.info Team · Written with AI · fact-checked ·
Exposed Cairn panels gave attackers a way to direct the AI agents that were supposed to be testing systems, NorForge says. But the company’s investigation stops short of claiming that AI itself ran the attacks: the campaigns appear scripted, with people likely stepping in at key points.
NorForge says the intrusions began in earnest on October 20, 2026, and may have started earlier. Attackers added tasks to at least 17 internet-exposed Cairn panels, including installations used by red teams and capture-the-flag exercises. The tasks turned agents against the machines running them, rather than against the outside targets the panels’ owners had set.
Exposed Cairn panels let outsiders assign work
Cairn organizes agent work around a goal and a starting point. Its panel displays active projects and findings; someone with access can also create tasks, stop them or delete them. On an unprotected installation, that control surface can let an outsider put instructions directly in front of an agent.
NorForge first noticed 11 unusual tasks on a panel associated with a previously tracked activity cluster. The tasks targeted the local Cairn host and included an instruction to add an unfamiliar SSH public key to the kali user’s authorized_keys file. The panel’s task output indicated that the agent carried out the change. NorForge says the malicious tasks then disappeared while it was watching.
Two task patterns point to separate clusters
NorForge found similar activity on other panels and identified two task-naming styles. One used random hexadecimal suffixes; the other imitated Cairn’s own intent labels, which begin with “i” followed by three digits. The firm tracks them as AIA0009 and AIA0010, respectively.
The first cluster focused on persistence and malware delivery, while the second ran reconnaissance, searched for credentials and examined agent infrastructure. NorForge found no conclusive overlap tying the clusters to the same operators. NorForge founding researcher Snorre Fagerland writes:
“For now, we are operating under the assumption that there are two separate groups compromising these Cairn panels, but that assessment might change should new data surface.”
A task downloaded a Poseidon remote-access implant
NorForge documented a later task that instructed an agent to decode and run a script. The script downloaded a Linux binary, checked its SHA-256 hash and launched it in the background. NorForge identified the file as Poseidon, a Go-based remote-access implant commonly managed through the Mythic red-team framework.
The malware task remained active until an operator-provided STOP file was present, while the Poseidon implant itself was launched separately in the background. NorForge says it observed malware deployment only in AIA0009 activity. The researchers also found tasks that searched system files and environment variables for credentials, with some results placed in panel “facts” visible to anyone who could access the exposed interface.
NorForge finds scripting, not proof of AI orchestration
The synchronized bursts of tasks across separate panels led NorForge to describe the campaigns as automated. The company says the evidence shows at least scripting, but does not establish that an AI agent planned or controlled the intrusions. Pauses before malware deployment, including time to prepare command-and-control and download infrastructure, suggest people intervened at important stages.
NorForge says it observed the panels passively. It warns that exposed Cairn installations can be manipulated and that agents may have access to secrets, local services and host resources, depending on how they are run. The firm points to container isolation as a boundary that can limit an agent’s reach, though it also notes that attackers explored container settings and other routes toward broader access.