----------------
🛠️ Tool
===================
Cairn: agent engine that runs penetration testing as state-space search
chainreactors published Cairn, a project developed for Tencent's hackathon. The positioning is unusual: instead of an "AI pentest assistant", it is described as a general-purpose problem-solving engine. Given an origin and a goal, it searches for a path through an unknown state space. Penetration testing is the first domain where the engine has been validated, and the README claims broader applicability to vulnerability research, CTF, and even mathematical proofs. The README itself flags pentesting as the only validated domain so far.
Key features
• Blackboard architecture with an explicit fact-intent graph. Three primitives carry all state: Fact (a confirmed, objective finding written to the board), Intent (a declared exploration direction that has not been executed yet), and Hint (human judgment injected at any time, absorbed by agents on their next read).
• Role-free agents. Workers hold no job descriptions. Tasks are generated at runtime from the current graph state.
• OODA loop per worker. Observe the full graph, orient on the current state, decide the next Intents, act, and write findings back as new Facts.
• Stigmergy-based coordination. Agents communicate exclusively through the shared board. No direct messaging and no information silos.
• Human-in-the-loop via Hints. An operator can steer the search mid-run without restarting it.
Technical implementation
The Cairn server holds Facts, Intents and Hints behind a read/write API, and a Dispatcher assigns tasks to workers. The graph grows from origin toward goal: every confirmed Fact is a stepping stone, every Intent is a step into the unknown. Three task types run on the same worker type. Bootstrap attempts to solve the problem directly at project start. Reason reads the full graph, checks whether the goal is met, and emits new Intents or a no-op. Explore claims exactly one Intent, executes it, and reports one Fact back. The README's architecture diagram cuts off at the Dispatcher, so details on scheduling, concurrency, sandboxing and the underlying model are not documented yet.
Use cases
For red teams, the interesting scenario is a pentest run where the plan emerges from confirmed findings instead of a predefined playbook, with the operator nudging the search through Hints. The claimed future domains are vulnerability research and CTF solving, both shaped the same way: known origin, defined goal, unknown path.
Setup
The README links a Bilibili demo video and a Discord community but documents no installation or configuration steps as of now. Note: haven't tested personally.
Limitations
"General problem-solving engine" is a strong claim backed by exactly one validated domain. There are no benchmarks, no model identification, no token cost estimates, and no solve-rate numbers against standard lab targets. Stigmergy-only coordination raises an open question the README does not address: what stops two workers from burning effort on the same dead-end Intent. There is also no mention of guardrails around destructive exploitation steps, which matters before pointing this at anything real.
References
Repository: Cairn by chainreactors on GitHub. Author contact: le1xia0 on X. Demo video and Discord linked from the README.
🔹 tool #Cairn #pentesting #AI #agenticAI
🔗 Source: https://github.com/oritera/Cairn