NorForge Details 20+ Exposed Cairn Panels Used in AI-Driven Intrusions

Security research firm NorForge on October 19, 2026 published Inside Cairn, an investigation that identified more than 20 publicly exposed control panels for the Cairn AI problem-solving harness as likely associated with malicious, financially motivated intrusion activity. The exposed panels provide a detailed view of how threat actors choose targets, task autonomous agents, exploit vulnerabilities, and establish persistent access in compromised systems, the firm said.

The report was written by Snorre Fagerland, a founding researcher at NorForge, an employee-owned company founded in 2026 with a US parent headquartered in Palo Alto and a European operating subsidiary. Because the panels reveal target identities, uncovered weaknesses, account secrets, API keys, and compromise status, NorForge said it aggressively redacted extracted data and is withholding panel addresses until they can be taken down.

The firm added that a considerable number of apparently legitimate red-team operations were also found exposed in the same way, potentially placing their clients at risk. NorForge said its searches began after Gambit Security reported in September 2026 on a criminal intrusion campaign targeting online marketplaces that used AI harnesses including…