Threats · 6h ago
Norforge identified three malicious Cairn clusters automating website attacks, with the largest running more than 1,100 projects across 14 dashboards. Norforge says the clusters pursued persistent access and financial theft; Reuters separately reports that the largest actor breached more than 100 companies.
Cairn lets operators set a target and goal, then coordinate AI agents that work through steps and post findings to a shared board. With panels left open, operators could use them as control surfaces. Norforge found hundreds of stored secrets in panel data, 11% verified as valid. The clusters pursued webshell, administrator-panel, database, and payment access, so valid credentials could open routes beyond Cairn—but the reporting does not establish which secrets were used or which footholds remain.
For Cairn deployments, the dashboard is only one boundary: closing an exposed panel would not establish whether its credentials were used or access persisted in a target system. For organizations among the reported victims, the scope of downstream exposure remains unsettled.
3 sources covering this story
AI Pen-Test Tool Cairn Abused to Automate Massive Attack Spree
A Chinese-speaking actor compromised 100s of websites across the globe, looting from big fish like John Deere, SharkNinja, and engine manufacturer Cummins.
Hackers Use Autonomous AI Agents to Breach Company Websites, Target Over 1,200 Sites
Exposed Cairn panels reveal autonomous AI attacks on over 1,200 websites, with confirmed breaches and leaked credentials.
AI Platform Cairn Abused to Hack Over 100 Organizations
At least three threat actors have been abusing Cairn for persistent access and financial theft.
Part of the PlainSec briefing for 2026-10-20