AI agents in cyberattacks: What the NorForge Cairn investigation proves
NorForge found 20+ exposed Cairn panels used in suspected AI cyberattacks. What 1,100 projects prove, what remains unverified, and how to respond.
On October 19, NorForge documented more than 20 publicly accessible Cairn control panels that researchers assessed as likely tied to malicious AI-driven cyber operations. One Chinese-language cluster contained 14 panels and over 1,100 attack projects. NorForge independently verified at least one claimed compromise. The number of truly breached websites, however, cannot be established from dashboard task records alone.
AI-assisted intrusions had already been reported, but the way malicious operators directed agents, selected targets and recorded outcomes was rarely observable outside a narrow investigation.
Exposed Cairn control panels revealed target lists, agent decisions and claimed outcomes. One large cluster illustrates operational scale, not a validated success rate for each attempted attack.
More than 20 exposed control panels, not just a dramatic claim
The strongest evidence comes from an operational mistake: some attackers left their Cairn dashboards reachable without authentication. NorForge identified more than 20 panels it assessed as likely malicious. The largest cluster, AIA0001, comprised 14 panels and over 1,100 projects, mainly aimed at ecommerce and payment infrastructure in the United States, Japan and Australia. Crucially, a project is not the same thing as a confirmed intrusion. Targets, attempts, completed goals and independently validated breaches must be counted separately.
Cairn moves work from an initial state towards an operator-defined goal. AI workers publish observations and planned actions to a shared blackboard; humans can add hints along the way. That combination of automated targeting, tool use and repeated attempts matters more than claims of a fully independent super-hacker. The system operates inside a concrete workflow with human tasking and many intermediate decisions.
Which intrusions were verified?
NorForge checked at least one case marked successful by an agent and found an active upload web shell at a hardware-parts supplier. The report includes additional attack-chain examples, but it does not offer a fully independent public validation of every task. Its roughly ten-percent success estimate concerns the observed campaigns and is not a universal agent-hacking success rate. Successful AIA0001 projects took a little under 23 hours on average, with wide variation.
Reuters separately reported more than 100 affected websites and sought responses from named companies. Deere said it had taken remedial action and had no indication that sensitive data was accessed; SharkNinja said a standalone support site was affected and contained. Neither statement demonstrates broad exfiltration across all named firms. Likewise, a worker label visible in dashboards is insufficient proof of the actual underlying model or provider; NorForge treats model attribution as tentative.
Defensive lessons beyond the headline
The exposed dashboards represented a second security problem. NorForge's scan of recovered panel data found hundreds of secrets, with around eleven percent verified as valid by an automated secrets checker. An authorized red team could create similar risk if it exposed a customer assessment system. Operators should protect control planes with authentication and network isolation, rotate exposed credentials, scope agent permissions and keep auditable records of tool actions.
For defenders running public services, basic hygiene remains essential: patch known issues, harden upload and administrative paths, monitor unusual automation and exercise incident recovery. AI agents do not automatically invent new vulnerabilities, but they can persistently search for existing weaknesses at lower operational cost. The defensible conclusion is increased attack throughput and fragile oversight—not that every AI tool is malicious or every site listed in a task was breached.
AgentenCode analysis
The consequential shift is scale: one operator can keep many agent-driven probes running for hours. Yet the same evidence exposes unreliable success claims and the attackers' own poor security. Reducing the story to a sensational count of hacked companies hides the central lesson: verify individual outcomes, maintain realistic denominators and secure agent infrastructure on both sides.
Sources and verification
Editorial assessment of NorForge's October 19 primary investigation and Reuters' interviews with affected companies. AgentenCode did not perform an independent forensic investigation or audit every claimed compromise.