AI Platform Cairn Abused to Hack Over 100 Organizations

What it is

Cairn is an open source, general-purpose problem-solving engine that coordinates AI agents toward a set goal, and it can run as an autonomous penetration testing engine. Norforge found three apparently malicious clusters using it against e-commerce and payment targets, after a Gambit Security report on attackers using three AI harnesses against online retailers.

How it works

Each Cairn task is a project with an origin and a predefined goal. Agents work step by step from origin to goal and post their intents and findings to a shared blackboard. Norforge could see the attacks because operators left their panels open to the internet.

In the largest cluster, the operator ranked targets by traffic and tested them with Microsoft's Playwright browser automation framework before feeding them to Cairn. That cluster used Chinese language, ran over 1,100 projects across 14 dashboards, and aimed for persistent webshell access to large platforms, likely to be monetized later.

Other clusters

• Second cluster: 10 exposed panels, English language. It targets credit card and cryptocurrency theft, mainly from merchant payment services, gray-market payment sites and pharmaceutical platforms. Some targets are African commerce sites, and Norforge believes the actor is based in Africa.
• Third cluster: one panel with 59 projects against all types of e-commerce sites, including very large US platforms. It seeks shell access, admin panel access and database access.

Preconditions / Affected

The targets are e-commerce and payment sites, with the largest cluster focused on the US, Japan and Australia. The page gives no vulnerability, version or exploit path, so it does not say what made the victims exploitable.

Caveats

• Norforge named no victims. John Deere and SharkNinja come from Reuters, which says the largest cluster's actor breached over 100 companies.
• Attackers succeeded in roughly 10% of attempts. Of the hundreds of secrets found in the exposed panel data, 11% were verified as valid.
• The page offers no detection queries, indicators of compromise or mitigations. Defenders get the target profile and the webshell, admin and database access goals, but nothing to hunt with directly.