Found by scanning for careless attackers
In September, Gambit Security recovered a staging server from a criminal campaign against online marketplaces and named the AI harnesses sitting on it: Hermes, Strix and Cairn. The Norwegian-American security firm NorForge took that as a lead, pointed the Shodan and Censys scanners at the open internet, and looked for Cairn installations whose operators had never put a password on the web interface.
It found more than 20 that it assesses as malicious, plus a number of apparently legitimate red-team engagements left equally exposed. The resulting report, published on 19 October by principal threat researcher Snorre Fagerland, is an unusually direct look at how autonomous agents are being used to break into commercial websites — because the attackers’ own dashboards show every step.
Cairn is not an attack tool by design. NorForge describes it as a state-based problem-solving engine: each job is a project with an origin and a goal, and the agents move between them in cycles of “intents” and “facts”, posting every discovery to a shared blackboard that other workers read. A human operator can add hints to the same board. Posting as le1xia0 on X, Cairn’s author said the project was not built for hacking.
Three clusters, and one that industrialised it
NorForge groups the activity into three clusters. The largest, which it labels AIA0001 and assesses as malicious with high confidence, runs in Chinese across 14 panels and more than 1,100 attack projects. Its targets are e-commerce sites in the United States, Canada, Japan and Australia, and the goal is persistent access to shop and payment infrastructure.
The tasking is industrial. One typical instruction, quoted in the report, tells the agents the targets are “confirmed real shopping/e-commerce websites” in those four countries with between 200,000 and 1.5 million in traffic, already checked with Microsoft’s Playwright browser automation to confirm that orders can actually be placed. The objective is unauthenticated remote code execution; the payload is specified as an uploader shell, explicitly not a command-executing web shell.
The second cluster, AIA0002, works in English across 10 panels and is oriented towards theft rather than access — credit cards and cryptocurrency, with many projects carrying no technical instructions beyond “fetch credit cards”. A third, with a single panel and 59 projects, NorForge rates malicious only with low confidence.
About $5 a task, and a 10% hit rate
In AIA0001, every task was executed by a worker named claudecode_deepseek-v4.1-flash, which NorForge reads as a Claude Code harness calling DeepSeek’s V4.1 Flash model. The firm has no token figures and stresses the uncertainty, but estimates the average task at around $5 including the projects that fail early; the longest, with more than 1,000 intents and facts, could exceed $100.
Across the clusters NorForge puts the average success rate at roughly 10%. Within AIA0001, the average time from project start to goal met was a little under 23 hours, generating about 140 facts per project. One project ran for more than five days.
The researchers verified one claimed intrusion themselves, fetching the shell URL from a completed project against a large hardware parts vendor. It was live. By the agent’s own account, the route in combined unauthorised write access to a memcached session store with unsafe PHP object deserialisation and a gadget chain in legacy Zend Framework components.
The dashboards are themselves the breach
The second finding is the one defenders should act on. An open Cairn panel does not just reveal that a site is being attacked; it publishes everything the agents learned along the way, plus whatever credentials the human operator pasted in. NorForge ran the Trufflehog scanner over the data and found hundreds of secrets, 11% of which the tool verified as still valid.
The panels also appear to expose the full administrative interface — starting and stopping projects, inserting data, redirecting agents at new targets. NorForge says it did not test whether those controls work without authentication, for obvious reasons, but the implication stands: autonomous offensive agents sitting behind an unlocked door.
Reuters, which reviewed the report before publication, named Deere, SharkNinja and Cummins among the victims. Deere said it took remediation steps and saw no sign sensitive information was accessed; SharkNinja said the attack hit a standalone product support site and was contained; Cummins said it was investigating a possible attack on a site run by one of its vendors.
NorForge is working with Reuters to warn victims and asking hosting providers to take the panels down. Whether that works depends on the hosts. The cheaper signal is the one the report ends on: the same operators who left their panels open are the ones whose tooling was traceable at all.
