NorForge finds 20+ exposed AI hacking agent panels

Criminals are running AI hacking agents at volume, and some of them left the control room unlocked.

Security firm NorForge published an investigation on Monday into more than 20 exposed control panels for Cairn, an AI-driven penetration testing tool, that it rates as "likely associated with malicious activity." One cluster of panels alone held over 1,100 attack projects.

This is the cheap, boring version of AI-powered hacking. That is why it should worry you.

What NorForge found inside the panels

NorForge says it started after Gambit Security's September report on a criminal campaign against online marketplaces, which found AI agent tools, Cairn among them, on an attacker's staging server. NorForge then searched Shodan and Censys for more exposed Cairn panels and kept scanning as new ones appeared.

It groups what it found into three clusters, by its own labels:

• AIA0001: Chinese-language, 14 panels, over 1,100 attack projects, aimed mostly at e-commerce and payment systems in the US, Japan and Australia.
• AIA0002: English-language, 10 panels, focused on stealing card and cryptocurrency data from merchant, gray-market and pharmacy sites.
• AIA0003: one panel with 59 projects, which NorForge rates low confidence and more exploratory.

All of it looked financially motivated, NorForge says. It found no obvious state-sponsored activity, while noting that state actors may lock their dashboards better.

Each Cairn project has an origin and a goal, and its AI agents post facts and intents to a shared board as they work. Worker names in AIA0001 read "claudecode_deepseek-v4.1-flash," which NorForge says "could mean" a Claude Code agent harness driving DeepSeek's V4.1 Flash model. AIA0002 worker labels name OpenRouter and DeepSeek.

The numbers NorForge gives are estimates, and it says so:

About 10% of tasks reached their goal.

The average cost was "around $5" per task, including the ones that ended early, with large projects possibly running past $100. NorForge says its cost figures "could be off by a clear margin."

The exposed data also held "hundreds of secrets," of which NorForge says 11% checked out as valid. No victims are named. The case studies include an Australian e-commerce site, a restaurant point-of-sale system, a Japanese retailer and US retailers. NorForge says it is working with Reuters to notify victims.

Cheap attempts change the math

Yes, a 10% success rate sounds bad. For an attacker it is a business model.

On NorForge's own rough figures, that works out to something like $50 of compute per successful intrusion, with no human typing commands. An attacker no longer needs to pick targets carefully. They can try everything.

TopFive covered an AI pentest agent used against Korean banks earlier this month. That was a capable tool in the wrong hands. This looks like cheap models in common tools, aimed at whoever runs an online store.

If you run a store, a POS or an API

NorForge does not offer defenders a checklist. The targets it lists tell you enough.

Patch the boring stuff: public web apps, plugins, upload forms. In one case NorForge checked, a live web shell was being served from a hardware parts vendor's site.

Get secrets out of code and config files you serve. Rotate any key that has ever sat somewhere public.

Watch for patient, low-and-slow probing. An agent that costs $5 a run can afford to come back.

And if you run your own red teaming tools, lock down their dashboards. NorForge says some apparently legitimate red-team operations were exposed too.

What to watch

Whether hosting providers take the panels down. NorForge is pushing for it and says that "might not be possible."

Whether model providers act on the accounts behind these workers.

Assume the agents are already knocking.