← All incidents

Exposed Cairn panels show AI agents running break-in campaigns, one through a Claude Code harness driving a DeepSeek model, NorForge says

Misuse · Cairn (open-source agent platform); Claude Code harness and Pi coding agent (misused; DeepSeek models per NorForge) · HIGH

Summary

On Oct 19, 2026, the security company NorForge published research on more than 20 publicly exposed, unauthenticated control panels for Cairn, an open-source AI agent platform, that it assesses as likely used for criminal intrusions. The panels let NorForge watch attackers hand a target and a goal to AI agents, which then probed the site and tried to break in largely on their own. The busiest group, which NorForge calls AIA0001, works in Chinese and ran over 1100 attack projects across 14 panels, mostly against e-commerce and payment sites in the US, Japan and Australia, with the aim of planting a file-upload webshell for later access. Every task NorForge saw from this group ran on a worker named claudecode_deepseek-v4.1-flash, which NorForge says 'could mean a Claude Code harness using the Chinese DeepSeek 4.1 Flash model'. In other words, Anthropic's Claude Code tool appears to have been driving a DeepSeek model, not one of Anthropic's own models. A second group, AIA0002, ran workers named pi_openrouter_deepseek, which NorForge reads as the Pi coding-agent framework using DeepSeek models through OpenRouter. Reuters, which reviewed the Chinese-speaking attacker's Cairn activity itself, reports more than 1,200 sites attempted and websites of more than 100 companies broken into since Sep 25. The open panels also leaked the victims' own data: NorForge found hundreds of secrets in them, 11% verified valid. We found no public statement from Anthropic or DeepSeek as of Oct 20, 2026. This is misuse of AI tools by attackers, not a flaw in Claude Code, Pi, DeepSeek or Cairn.

Severity

Timeline

1. Sep 22, 2026
   Gambit Security reports a separate, earlier campaign against online retailers that used the Strix, Cairn and Hermes agent harnesses. Gambit says DeepSeek v4.1 Flash was the model in its Cairn attacks. NorForge says this report prompted its own search.
2. Sep 25, 2026
   Reuters says the Chinese-speaking attacker starts sending AI agents against US, Canadian, Australian and Japanese e-commerce websites.
3. Oct 2, 2026
   Around this date, NorForge's Snorre Fagerland begins finding Cairn instances used for malicious activity, about two dozen in all (per Reuters).
4. Oct 19, 2026
   NorForge publishes 'Inside Cairn'. Reuters publishes its own report on the same activity, and The Verge follows. NorForge says it is working with Reuters to notify victims and trying to get the panels taken down.

How it happened

Cairn describes itself as a general-purpose problem-solving engine: the operator sets a starting point and a goal, and agent workers post the facts they find and their next intents to a shared board until the goal is met or the project stops. NorForge found Cairn's web panels through internet-scanning services. Some were empty, protected or apparently legitimate red-team work. More than 20 were open, with no login, and contained clearly criminal tasks. NorForge groups them into three clusters. AIA0001 (Chinese language, 14 panels hosted on AS56594, high confidence) fed in targets through an automated pipeline: shopping sites ranked by traffic and checked with Playwright that orders could be placed, with a standing goal of unauthenticated code execution and a simple uploader webshell as the payload. A briefly exposed worker directory showed a Kali container with Playwright, PHPGGC, Nmap, ffuf, Amass and similar tools, and a Claude Code skill file apparently reused from a Tencent CTF setup. NorForge says there is no reason to think Tencent was involved. NorForge puts the average cost at around $5 per task, with considerable uncertainty. Reuters reports Fagerland's estimate as about $5,000 in tokens overall, or about $50 per successful hack. Reuters also describes the campaign as appearing to use 'a mixture of China's DeepSeek and Anthropic's Claude Code'. NorForge's worker name and Gambit's earlier finding both point to Claude Code as the harness and DeepSeek as the model. AIA0002 (English language, 10 panels, mostly Vultr hosting) went after card and crypto theft, sometimes with tasks as short as 'fetch credit cards'. AIA0003 (one panel, 59 projects) is low confidence. NorForge estimates an average success rate of around 10%. Successful AIA0001 projects took a little under 23 hours and logged about 140 facts each. NorForge checked one claimed break-in and found a live uploader webshell on a large hardware-parts vendor's site, reached, according to the agent's own notes, through a writable memcached session store and unsafe PHP deserialization. The second finding is the exposure itself: the panels hold targets' weaknesses, harvested credentials and API keys. Trufflehog found hundreds of secrets, 11% verified valid. The panels also appear to expose full admin controls, which NorForge did not test. Reuters says it identified victims by reviewing the attacker's Cairn activity, and names Deere, SharkNinja and Cummins. Deere told Reuters it had taken 'necessary remediation actions' and had 'no indication that sensitive information was accessed'. SharkNinja told Reuters the hack hit a standalone site carrying only product support information and that the threat was contained. Cummins told Reuters and The Verge it was 'investigating the report of a potential cyber-attack on a website operated by one of our third-party vendors'. Reuters says two smaller businesses also acknowledged being compromised and that it could not establish how much data was taken. Cairn's author, le1xia0, has said on X that the platform was not designed for hacking attacks.

How to check your app

• If you run an online store, assume automated agents are probing it around the clock. Patch the platform and plugins promptly, especially file upload, deserialization and login paths, and remove legacy components you no longer need.
• Look for unexpected PHP files in web and upload directories, especially small upload forms. NorForge's AIA0001 payload was an uploader shell rather than a command shell, so it can look harmless.
• Keep session stores such as memcached and Redis off the public internet. NorForge's confirmed intrusion started with write access to one.
• Block or hunt for NorForge's published AIA0002 staging servers, 199.247.25.25 and 199.247.27.2. NorForge has withheld the full panel addresses but offers them to bona fide researchers.
• If you run Cairn or any other agent control panel, including for legitimate red-team work, put it behind authentication and keep it off the open internet. NorForge found client secrets sitting in open red-team panels too.
• Don't paste credentials or API keys into an agent's task board unless the board is locked down. Rotate anything that has been.

Related on VibeIncidents

• Attacker used the ARTEX pentest agent and Claude Code sessions on other models against South Korean banks
• PaperCut servers mass-exploited by AI agents on a Codex harness with a DeepSeek model, GreyNoise says

Sources

• NorForge: Inside Cairn: Open Windows into massive AI-Driven Cyber Operations (Snorre Fagerland, Oct 19, 2026)
• Reuters (via Yahoo News): Exclusive: How one hacker used AI agents and a few thousand dollars to break into scores of sites (Oct 19, 2026)
• Reuters (via Honolulu Star-Advertiser): How one hacker used AI agents to break into over 100 company websites (Oct 19, 2026)
• The Verge: A hacker broke into John Deere and SharkNinja with an army of AI agents (Oct 19, 2026)
• Gambit Security: Autonomous AI Agents are breaking into hundreds of Online Retailers for $25 a target (Eyal Sela, Sep 22, 2026)

Corrections and updates

None. Re-checked against every source on Oct 20, 2026.