# NorForge reports over 20 exposed Cairn panels likely linked to malicious intrusions

Digest AI · Agents & Tools · published 2026-10-19T13:02:13Z · updated 2026-10-19T13:58:41Z

Canonical: https://digestai.news/story/norforge-reports-over-20-exposed-cairn-panels-likely-linked-to-malicio

## Summary

Security research firm NorForge disclosed on October 19, 2026 that it had identified more than 20 publicly exposed control panels for the Cairn AI problem‑solving harness. The panels, which show target identities, vulnerabilities, API keys and compromise status, were redacted by NorForge and the addresses are being held back pending takedown. The investigation, written by founding researcher Snorre Fagerland, also found a number of legitimate red‑team panels exposed in the same way, raising additional client‑risk concerns.

NorForge grouped the activity into three clusters. The largest, AIA0001, runs on 14 panels hosted by Cgi Global Limited (AS56594) and contains over 1,100 attack projects targeting e‑commerce and payment infrastructure in the US, Japan and Australia. Tasks aim at unauthenticated remote code execution, using tools such as Playwright, Chromium, PHPGGC and CVE‑2026‑75650 exploits. The firm estimates an average cost of about $5 per task, with some projects exceeding $100, and a success rate around 10%, reaching goals in under 23 hours on average. A second cluster, AIA0002, uses 10 panels on Vultr VPS instances (AS20473) and openly discusses stealing credit cards and crypto, while a smaller AIA0003 cluster lists 59 projects on a single AlexHost panel. NorForge is cooperating with Reuters and hosters to remove the panels and will share unredacted indicators with vetted researchers.

## Key points

- NorForge found >20 publicly exposed Cairn AI panels, many likely tied to financially motivated intrusion activity.
- Cluster AIA0001 hosts 14 panels, 1,100+ attack projects targeting US, Japan, Australia e‑commerce, with ~10% success rate.
- Average task cost is about $5, some exceeding $100, and average time to reach goals is under 23 hours.

## Why it matters

Exposed AI penetration‑testing panels reveal cheap, automated attacks on e‑commerce and payment systems, highlighting urgent security gaps in AI harness deployments.

## Sources

1. [NorForge Details 20+ Exposed Cairn Panels Used in AI-Driven Intrusions](https://unite.ai/norforge-details-20-plus-exposed-cairn-panels-used-in-ai-driven-intrusions) (Unite.AI, 2026-10-19)
2. [A hacker broke into John Deere and SharkNinja with an army of AI agents](https://theverge.com/ai-artificial-intelligence/1013643/ai-agents-hack-john-deere-shark-ninja-cummins) (The Verge AI, 2026-10-19)

## Cite

Digest AI, "NorForge reports over 20 exposed Cairn panels likely linked to malicious intrusions", 19 October 2026, https://digestai.news/story/norforge-reports-over-20-exposed-cairn-panels-likely-linked-to-malicio

---

Written by Digest AI's editorial model from the linked sources; the sources are the record. Headlines, digests and key points are written by Digest AI and may be quoted with a link to the story page. Linked articles belong to their publishers. Terms: https://digestai.news/terms#reuse
JSON: https://digestai.news/story/norforge-reports-over-20-exposed-cairn-panels-likely-linked-to-malicio.json