NorForge reports over 20 exposed Cairn panels likely linked to malicious intrusions
Security research firm NorForge disclosed on October 19, 2026 that it had identified more than 20 publicly exposed control panels for the Cairn AI problem‑solving harness. The panels, which show target identities, vulnerabilities, API keys and compromise status, were redacted by NorForge and the addresses are being held back pending takedown. The investigation, written by founding researcher…
Key points
- NorForge found >20 publicly exposed Cairn AI panels, many likely tied to financially motivated intrusion activity.
- Cluster AIA0001 hosts 14 panels, 1,100+ attack projects targeting US, Japan, Australia e‑commerce, with ~10% success rate.
- Average task cost is about $5, some exceeding $100, and average time to reach goals is under 23 hours.
NorForge grouped the activity into three clusters. The largest, AIA0001, runs on 14 panels hosted by Cgi Global Limited (AS56594) and contains over 1,100 attack projects targeting e‑commerce and payment infrastructure in the US, Japan and Australia. Tasks aim at unauthenticated remote code execution, using tools such as Playwright, Chromium, PHPGGC and CVE‑2026‑75650 exploits. The firm estimates an average cost of about $5 per task, with some projects exceeding $100, and a success rate around 10%, reaching goals in under 23 hours on average. A second cluster, AIA0002, uses 10 panels on Vultr VPS instances (AS20473) and openly discusses stealing credit cards and crypto, while a smaller AIA0003 cluster lists 59 projects on a single AlexHost panel. NorForge is cooperating with Reuters and hosters to remove the panels and will share unredacted indicators with vetted researchers.
NorForge Details 20+ Exposed Cairn Panels Used in AI-Driven Intrusions
Unite.AI · 19 October 2026
Loading the full article…
This text was published by Unite.AI and written by Miles Okada, AI & Cybersecurity, AI Research Agent. It is reproduced here with attribution so you can read it in full; the rights remain with the publisher. Read it at the source ↗
The headline, key points and digest above were generated by Digest AI's editorial model from the linked sources. Automated summaries can contain errors: the sources are the record. Spotted a mistake? Tell us. Published by Martin K., who runs Digest AI and handles corrections.
More in Agents & Tools
All →- SandboxAQ adds Switch Trust and Switch ROI tools to its Switch AI platform · 1 src
- Anomaly Innovations says breach affected about 1.4% of OpenCode Console users · 3 src
- Microsoft outlines Project Perception to guard agentic insiders · 2 src
- Google's Gemini 4 agents defeat Minecraft Ender Dragon without human input · 2 src
- Meta may write a $100 billion-$200 billion check for Muse Wonder, says Zuckerberg · 2 src
Comments
via GitHub Discussions