{"version":1,"type":"story","url":"https://digestai.news/story/norforge-reports-over-20-exposed-cairn-panels-likely-linked-to-malicio","json":"https://digestai.news/story/norforge-reports-over-20-exposed-cairn-panels-likely-linked-to-malicio.json","markdown":"https://digestai.news/story/norforge-reports-over-20-exposed-cairn-panels-likely-linked-to-malicio.md","slug":"norforge-reports-over-20-exposed-cairn-panels-likely-linked-to-malicio","headline":"NorForge reports over 20 exposed Cairn panels likely linked to malicious intrusions","summary":"Security research firm NorForge disclosed on October 19, 2026 that it had identified more than 20 publicly exposed control panels for the Cairn AI problem‑solving harness. The panels, which show target identities, vulnerabilities, API keys and compromise status, were redacted by NorForge and the addresses are being held back pending takedown. The investigation, written by founding researcher Snorre Fagerland, also found a number of legitimate red‑team panels exposed in the same way, raising additional client‑risk concerns.\n\nNorForge grouped the activity into three clusters. The largest, AIA0001, runs on 14 panels hosted by Cgi Global Limited (AS56594) and contains over 1,100 attack projects targeting e‑commerce and payment infrastructure in the US, Japan and Australia. Tasks aim at unauthenticated remote code execution, using tools such as Playwright, Chromium, PHPGGC and CVE‑2026‑75650 exploits. The firm estimates an average cost of about $5 per task, with some projects exceeding $100, and a success rate around 10%, reaching goals in under 23 hours on average. A second cluster, AIA0002, uses 10 panels on Vultr VPS instances (AS20473) and openly discusses stealing credit cards and crypto, while a smaller AIA0003 cluster lists 59 projects on a single AlexHost panel. NorForge is cooperating with Reuters and hosters to remove the panels and will share unredacted indicators with vetted researchers.","keyPoints":["NorForge found >20 publicly exposed Cairn AI panels, many likely tied to financially motivated intrusion activity.","Cluster AIA0001 hosts 14 panels, 1,100+ attack projects targeting US, Japan, Australia e‑commerce, with ~10% success rate.","Average task cost is about $5, some exceeding $100, and average time to reach goals is under 23 hours."],"whyItMatters":"Exposed AI penetration‑testing panels reveal cheap, automated attacks on e‑commerce and payment systems, highlighting urgent security gaps in AI harness deployments.","category":{"slug":"agents","name":"Agents & Tools","url":"https://digestai.news/category/agents"},"entities":{"companies":["NorForge","Gambit Security","Cgi Global Limited","The Constant Company","AlexHost","Microsoft"],"models":["Cairn","DeepSeek 4.1 Flash","Claude Code"],"people":["Snorre Fagerland","Varys"]},"firstPublishedAt":"2026-10-19T13:02:13Z","updatedAt":"2026-10-19T13:58:41Z","sourceCount":2,"hasPrimarySource":false,"sources":[{"outlet":"Unite.AI","title":"NorForge Details 20+ Exposed Cairn Panels Used in AI-Driven Intrusions","url":"https://unite.ai/norforge-details-20-plus-exposed-cairn-panels-used-in-ai-driven-intrusions","publishedAt":"2026-10-19T13:02:13Z","type":"press","primary":false,"lead":true},{"outlet":"The Verge AI","title":"A hacker broke into John Deere and SharkNinja with an army of AI agents","url":"https://theverge.com/ai-artificial-intelligence/1013643/ai-agents-hack-john-deere-shark-ninja-cummins","publishedAt":"2026-10-19T13:58:41Z","type":"press","primary":false,"lead":false}],"sourceNotes":null,"discussions":[],"thread":null,"cite":{"text":"Digest AI, \"NorForge reports over 20 exposed Cairn panels likely linked to malicious intrusions\", 19 October 2026, https://digestai.news/story/norforge-reports-over-20-exposed-cairn-panels-likely-linked-to-malicio","publisher":"Digest AI","title":"NorForge reports over 20 exposed Cairn panels likely linked to malicious intrusions","datePublished":"2026-10-19T13:02:13Z","url":"https://digestai.news/story/norforge-reports-over-20-exposed-cairn-panels-likely-linked-to-malicio"},"generatedBy":"Written by Digest AI's editorial model from the linked sources; the sources are the record.","license":"Headlines, digests and key points are written by Digest AI and may be quoted with a link to the story page. Linked articles belong to their publishers. Terms: https://digestai.news/terms#reuse"}