Norforge: Threat Actors Abuse Open-Source AI Platform Cairn to Hack 100+ Organizations

AI security firm Norforge reported that threat actors are abusing the open-source AI platform Cairn to automate malicious operations against hundreds of websites worldwide. The researchers identified three distinct clusters of malicious activity focused on gaining persistent access and stealing financial data from targeted organizations.

Norforge’s investigation followed a recent report by Gambit Security regarding hackers using AI harnesses to attack online retailers. During this review, Norforge discovered that some threat actors had left their Cairn panels exposed, allowing the security firm to analyze the underlying attack infrastructure and methodologies used by these groups.

Attack Infrastructure and Methods

Cairn is a general-purpose problem-solving engine designed to coordinate AI agents toward a specific goal, functioning as an autonomous penetration testing tool. Each task within the platform is defined as a project with a set origin and goal, where agents work step-by-step and share findings on a common blackboard to achieve the objective.

The largest identified cluster uses Chinese language and comprises over 1,100 attack projects across 14 dashboards. This group targeted e-commerce and payment infrastructure in the United States, Japan, and Australia. Norforge stated that the actor’s goal appears to be establishing persistent access to large platforms via webshells, likely for future monetization.

Automated validation processes were part of this campaign. Targets were ranked by traffic volume and tested using Microsoft’s browser automation framework, Playwright, before being fed into the Cairn system for further exploitation. Norforge noted that the threat actors were successful in roughly 10 percent of their overall attempts during this period.

Affected Sectors and Victims

A second cluster of activity exposed 10 panels and used English language communications. This group focused on credit card and cryptocurrency theft, primarily targeting merchant payment services, gray-market payment sites, and pharmaceutical platforms. Norforge believes this threat actor has a base on the African continent, as some targets included African commerce sites.

The third cluster exposed a single panel containing 59 projects targeting various e-commerce sites, including very large US-based commercial platforms. This group sought shell access, as well as access to admin panels and databases. Hundreds of secrets were found in the exposed panel data, with 11 percent verified as valid credentials by the researchers.

While Norforge did not name specific victims in its initial findings, Reuters reported that this threat actor breached over 100 companies. Among the confirmed victims were US-based equipment maker John Deere and home appliance firm SharkNinja, highlighting the significant reach of these automated campaigns.

What should you do?

Organizations should review their exposure to open-source AI and automation tools to ensure no sensitive panels or dashboards are publicly accessible. Security teams should monitor for unusual automation activity, particularly involving browser frameworks like Playwright, which may indicate reconnaissance or exploitation attempts.

What to do and how to stay safe: Cairn

• Audit all externally facing dashboards and API endpoints to ensure they require strong authentication and are not publicly accessible.
• Monitor web server logs for automated traffic patterns consistent with browser automation tools or known AI agent behaviors.
• Implement strict input validation and web application firewalls to detect and block attempts to upload webshells or gain shell access.
• Regularly rotate credentials and secrets, as exposed panels may contain valid tokens that attackers can use for lateral movement.

Step-by-step guide: Social Engineering Warning Signs and How to Respond

General security guidance from the Threat Times newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

What is the Cairn platform?

Cairn is an open-source, general-purpose problem-solving engine that coordinates AI agents to achieve specific goals, often used for autonomous penetration testing.

How many organizations were affected?

Reuters reported that over 100 companies were breached, while Norforge identified activity targeting hundreds of websites across multiple clusters.

What was the success rate of these attacks?

According to Norforge, the threat actors were successful in roughly 10 percent of their attempts to exploit the targeted systems.