Cairn AI Agents Linked to More Than 100 Site Intrusions

NorForge says it found more than 20 publicly exposed Cairn control panels likely tied to malicious activity. The platform coordinates AI agents that investigate targets and work toward goals set by an operator. In one Chinese-language activity cluster, NorForge counted more than 1,100 attack projects across 14 panels; The Next Web, citing Reuters’ review of the campaign, reported that agents tried more than 1,200 sites and that over 100 companies’ websites were breached. ^[1][2]

NorForge says it confirmed a live uploader web shell on one targeted site and found hundreds of exposed credentials and other secrets in panel data; its scanner marked 11% of those secrets as valid. The Next Web noted it had not independently verified the reported intrusions, and the available accounts do not establish how much data, if any, attackers took. ^[1][2]