----------------

🎯 AI
===================

NorForge published an investigation into publicly exposed control panels of AI-driven penetration-testing systems, with Cairn as the central case. The value here is documentation of actual offensive use of autonomous agent stacks, not a threat model on a slide.

Context

In September 2026, Gambit Security reported a criminal intrusion campaign against online marketplaces. The recovered attacker staging server showed AI harnesses in active use: Hermes, Strix, and Cairn. These tools ship with web UIs, and operators keep putting them on the open internet. Shodan and Censys queries surface hosts running various harnesses. Most require authentication. Some do not.

Findings per the source
• More than 20 exposed Cairn panels were assessed as likely associated with malicious activity. Targeting data, language, and task instructions connected several panels to the same actors.
• Panel content is unusually rich. A single open panel can disclose target identity, discovered weaknesses, account secrets, API keys, and whether a compromise already succeeded. One captured task view even showed root access to the attacker's own data drop.
• Legitimate red team operations appear in the same search results, which potentially puts their clients at risk.
• NorForge redacted extracted data aggressively and is withholding panel addresses until takedown. Treat instance-level specifics as unverified until publication.

How Cairn works
• Each task is a project with a defined origin and a predefined goal. The authors position Cairn as a state-based problem-solving engine rather than a dedicated pentest engine.
• Progress cycles through intents and facts. A fact is something an agent discovered. An intent is the next action it decided on.
• Facts go to a project-internal blackboard. Human operators can inject hints onto the same blackboard, and every worker agent reads it.
• The state graph renders visually. In the cited example, an attack against a major US online retailer converged from origin to a stated end of "GOAL MET: Webshell injected into the site."

Attack chain as described

1. Target selection: the operator feeds a target and objective in as a project.
2. Reconnaissance: agents investigate the target and post facts to the blackboard.
3. Exploitation: intents direct probing of weaknesses and break-in attempts.
4. Persistence: the sample run ended with a webshell injected into the site.

Implications, stated plainly:
• Agent-loop observability cuts both ways. The same blackboard that coordinates an attack also logs it for anyone who finds the panel.
• Anyone running agent harnesses should give the web console admin-panel treatment: authentication, network restrictions, and rotation of any keys that passed through it.
• Red teams should inventory their own deployments. Per the source, client exposure is a real risk, which is an uncomfortable finding for the industry.

Attribution remains the researchers' assessment, not confirmed actor identification. The available article text cuts off mid-section, so the full report may add detail on the legitimate operators.

🔹 Cairn #AISecurity #ThreatIntelligence #AutonomousAgents #OSINT

🔗 Source: https://norforge.com/blog/inside_cairn