Remote profile

----------------

🛠️ Tool
===================

Cairn: agent engine that runs penetration testing as state-space search

chainreactors published Cairn, a project developed for Tencent's hackathon. The positioning is unusual: instead of an "AI pentest assistant", it is described as a general-purpose problem-solving engine. Given an origin and a goal, it searches for a path through an unknown state space. Penetration testing is the first domain where the engine has been validated, and the README claims broader applicability to vulnerability research, CTF, and even mathematical proofs. The README itself flags pentesting as the only validated domain so far.

Key features
• Blackboard architecture with an explicit fact-intent graph. Three primitives carry all state: Fact (a confirmed, objective finding written to the board), Intent (a declared exploration direction that has not been executed yet), and Hint (human judgment injected at any time, absorbed by agents on their next read).
• Role-free agents. Workers hold no job descriptions. Tasks are generated at runtime from the current graph state.
• OODA loop per worker. Observe the full graph, orient on the current state, decide the next Intents, act, and write findings back as new Facts.
• Stigmergy-based coordination. Agents communicate exclusively through the shared board. No direct messaging and no information silos.
• Human-in-the-loop via Hints. An operator can steer the search mid-run without restarting it.

Technical implementation
The Cairn server holds Facts, Intents and Hints behind a read/write API, and a Dispatcher assigns tasks to workers. The graph grows from origin toward goal: every confirmed Fact is a stepping stone, every Intent is a step into the unknown. Three task types run on the same worker type. Bootstrap attempts to solve the problem directly at project start. Reason reads the full graph, checks whether the goal is met, and emits new Intents or a no-op. Explore claims exactly one Intent, executes it, and reports one Fact back. The README's architecture diagram cuts off at the Dispatcher, so details on scheduling, concurrency, sandboxing and the underlying model are not documented yet.

Use cases
For red teams, the interesting scenario is a pentest run where the plan emerges from confirmed findings instead of a predefined playbook, with the operator nudging the search through Hints. The claimed future domains are vulnerability research and CTF solving, both shaped the same way: known origin, defined goal, unknown path.

Setup
The README links a Bilibili demo video and a Discord community but documents no installation or configuration steps as of now. Note: haven't tested personally.

Limitations
"General problem-solving engine" is a strong claim backed by exactly one validated domain. There are no benchmarks, no model identification, no token cost estimates, and no solve-rate numbers against standard lab targets. Stigmergy-only coordination raises an open question the README does not address: what stops two workers from burning effort on the same dead-end Intent. There is also no mention of guardrails around destructive exploitation steps, which matters before pointing this at anything real.

References
Repository: Cairn by chainreactors on GitHub. Author contact: le1xia0 on X. Demo video and Discord linked from the README.

🔹 tool #Cairn #pentesting #AI #agenticAI

🔗 Source: https://github.com/oritera/Cairn

----------------

🎯 AI
===================

NorForge published an investigation into publicly exposed control panels of AI-driven penetration-testing systems, with Cairn as the central case. The value here is documentation of actual offensive use of autonomous agent stacks, not a threat model on a slide.

Context

In September 2026, Gambit Security reported a criminal intrusion campaign against online marketplaces. The recovered attacker staging server showed AI harnesses in active use: Hermes, Strix, and Cairn. These tools ship with web UIs, and operators keep putting them on the open internet. Shodan and Censys queries surface hosts running various harnesses. Most require authentication. Some do not.

Findings per the source
• More than 20 exposed Cairn panels were assessed as likely associated with malicious activity. Targeting data, language, and task instructions connected several panels to the same actors.
• Panel content is unusually rich. A single open panel can disclose target identity, discovered weaknesses, account secrets, API keys, and whether a compromise already succeeded. One captured task view even showed root access to the attacker's own data drop.
• Legitimate red team operations appear in the same search results, which potentially puts their clients at risk.
• NorForge redacted extracted data aggressively and is withholding panel addresses until takedown. Treat instance-level specifics as unverified until publication.

How Cairn works
• Each task is a project with a defined origin and a predefined goal. The authors position Cairn as a state-based problem-solving engine rather than a dedicated pentest engine.
• Progress cycles through intents and facts. A fact is something an agent discovered. An intent is the next action it decided on.
• Facts go to a project-internal blackboard. Human operators can inject hints onto the same blackboard, and every worker agent reads it.
• The state graph renders visually. In the cited example, an attack against a major US online retailer converged from origin to a stated end of "GOAL MET: Webshell injected into the site."

Attack chain as described

1. Target selection: the operator feeds a target and objective in as a project.
2. Reconnaissance: agents investigate the target and post facts to the blackboard.
3. Exploitation: intents direct probing of weaknesses and break-in attempts.
4. Persistence: the sample run ended with a webshell injected into the site.

Implications, stated plainly:
• Agent-loop observability cuts both ways. The same blackboard that coordinates an attack also logs it for anyone who finds the panel.
• Anyone running agent harnesses should give the web console admin-panel treatment: authentication, network restrictions, and rotation of any keys that passed through it.
• Red teams should inventory their own deployments. Per the source, client exposure is a real risk, which is an uncomfortable finding for the industry.

Attribution remains the researchers' assessment, not confirmed actor identification. The available article text cuts off mid-section, so the full report may add detail on the legitimate operators.

🔹 Cairn #AISecurity #ThreatIntelligence #AutonomousAgents #OSINT

🔗 Source: https://norforge.com/blog/inside_cairn