NorForge found 20+ exposed panels of Cairn, an AI intrusion harness three criminal clusters use on retailers: about 10% success at roughly $5 a task.
NorForge researchers have found more than 20 exposed control panels for Cairn, an AI harness that criminal groups use to run web intrusions against e-commerce and payment sites. The report, "Inside Cairn", appeared on 19 October 2026. It gives a view of AI-driven attacks as they run, not as a lab demo. Retailers, payment services and the Magento ecosystem are the main targets. Some security firms that run Cairn for legitimate testing are also exposed.
What NorForge found
NorForge groups the panels into three clusters, labelled AIA0001 to AIA0003 ("AI Activity"). The panels all listen on port 8000.
- AIA0001 is Chinese-language and runs 14 panels on AS56594 (Cgi Global Limited). NorForge rates it malicious with high confidence. It holds over 1,100 attack projects against shopping sites in the US, Canada, Japan and Australia with 200,000 to 1.5 million visits. Its aim is persistent access to e-commerce and payment infrastructure.
- AIA0002 is English-language and runs 10 panels, mostly on Vultr VPS (AS20473). It targets theft of cards and cryptocurrency, and goes after merchant payment services, gray-market and pharmaceutical sites, a carding site and several African commerce sites. NorForge lists staging servers 199.247.25.25 and 199.247.27.2.
- AIA0003 is one English-language panel on AlexHost (AS200019), rated low confidence. It has 59 projects, mixing small shops and large US platforms.
Some other exposed panels appear to belong to genuine penetration-testing firms. Their client data is exposed too.
What it says about AI-driven attacks
The average success rate is about 10%, by NorForge's estimate. Many other tasks reached partial goals or collected information for later use. The economics explain why that is enough. NorForge puts the average cost near $5 per task, failures included, though projects with more than 1,000 intents and facts can pass $100. It calls these figures uncertain. AIA0001 projects that reached their goal took a little under 23 hours on average, and the longest ran more than five days.
The agents do not rely on novel exploits. The listed techniques are login SQL injection, unauthenticated endpoints, file upload, PHP deserialization, authentication bypass, account takeover, SSTI, SSRF and business-logic flaws. The worker names suggest cheap models: claudecode_deepseek-v4.1-flash and pi_openrouter_deepseek. NorForge reads these as a Claude Code harness running DeepSeek 4.1 Flash, and the Pi coding agent using DeepSeek through OpenRouter. That is an inference from names.
How a Cairn project runs, per NorForge; the model attribution is inferred from worker names.
How a Cairn project runs, per NorForge; the model attribution is inferred from worker names.
NorForge confirmed two intrusions itself. At a large hardware parts vendor, the shell URL served a live uploader webshell. The agent said it had used unauthorized write access to a memcached session store, unsafe PHP object deserialization, and a gadget chain in legacy Zend Framework components. At a very large US retailer, the agent found a cookie that selected a vulnerable backend server. The report also describes a restaurant point-of-sale compromise and cases at an Australian shop and a Japanese retailer. No victims are named.
One CVE appears: CVE-2026-75650, a Magento chain from report poisoning to code execution (StyleSmuggler). The AIA0001 tooling includes a validation lab for Magento 2.4.9, plus PHPGGC, Playwright, Amass, dnsrecon, ffuf and Nmap.
The attackers' own exposure
The panels appear to offer full admin functions: starting and stopping projects, inserting data and redirecting agents. NorForge did not test whether these work without authorization. Trufflehog found hundreds of secrets, 11% of them verified valid. NorForge is working with Reuters to notify victims and will give unredacted indicators to bona fide researchers on request.
Gambit Security's September 2026 interim report, as summarized by Unite.ai, gives a sense of scale. It describes 105 attack projects launched on 10 to 15 September, at least 27 companies compromised, more than 600,000 unexpired card records taken from two companies, and skimmers confirmed on 19 sites.
What defenders should check
NorForge's article has no formal defender section. The points below are our reading of its findings.
- Patch and check Magento. Confirm exposure to CVE-2026-75650 and review stores for unexpected PHP files in upload and hidden directories. One AIA0002 example was a benign-looking
confirm.php. - Audit the basics at volume. Agents grind through common web flaws, so test login forms, upload handlers and deserialization paths first.
- Lock down session stores. Memcached must not accept unauthenticated writes, and legacy PHP libraries with gadget chains should go.
- Review routing cues. Check that no cookie or header can select a different or vulnerable backend.
- Watch for slow, persistent probing. Projects that run for hours or days across many intents will not look like a one-off scan. Alert on long sequences of varied requests from one source, and check logs against the published staging IPs and ASNs.
- Protect your own testers. If you hire pentesters, ask how they secure agent dashboards and client data.