Cairn's Latest Tag Is 10 May. The Panels Were Open.

US trends at 22:12 UTC were the NBA opener, Barca, and Vivek. Hacker News led with DeepInfer, Voxtral 3, and an eMudhra certificate compromise. Google News carried a Reuters exclusive on exposed Cairn panels. The primary is NorForge. Snorre Fagerland posted the report on 19 October.

High High because open panels held engagement records and secrets, 11 percent of which Trufflehog verified, and because NorForge says one claimed intrusion was still present. There is no CVSS score on this.

What NorForge reported.#

Cairn is the open-source project at oritera/Cairn. The repository description says it is a general-purpose state-space search engine, validated first on autonomous penetration testing. NorForge describes each task as a project with an origin and a goal. Agents write facts and intents to a shared board. A human can add hints to that same board.

NorForge found the panels through internet scan data. Most harness interfaces they saw asked for authorization. Cairn panels often did not. Over a few days they saw empty panels, protected panels, demos, and what looked like legitimate red-team work. They are not naming those red teams. They do say that putting a real customer test on an unsecured panel is a serious problem, including when the test itself fails, because the board holds what the agents found and what humans pasted in.

After filtering, more than 20 panels looked malicious. NorForge saw financial motivation and no obvious state-sponsored cluster. They split the activity into three clusters and say the clusters are not directly comparable.

AIA0001 uses Chinese, 14 panels, high confidence, hosted on AS56594 (Cgi Global Limited). NorForge counts over 1,100 attack projects, aimed at lasting access to e-commerce and payment systems, mostly in the United States, Japan, and Australia. Every task they saw in that cluster used a worker named claudecode_deepseek-v4.1-flash. NorForge says that name could mean Claude Code with DeepSeek 4.1 Flash. It does not confirm the model.

AIA0002 uses English, 10 panels, high confidence, hosted on AS20473 (The Constant Company, in most cases Vultr). Some of those links are less confident, and many panels have gone dark. The tasking talks about card data and cryptocurrency. Workers are named pi_openrouter_deepseek. NorForge reads that as the Pi coding agent calling DeepSeek through OpenRouter.

AIA0003 uses English, one panel, 59 projects, low confidence, hosted on AS200019 (AlexHost). Projects start by claiming to be authorized assessments and later talk about shell, admin, and database access.

For the harnesses in these campaigns, NorForge puts average success around 10 percent, with many other tasks partial. On AIA0001, the average from start to a met goal was a little under 23 hours, about 140 facts per project. One project ran more than five days. That is a snapshot, not a stable rate.

One worker update described its environment as a Kali container from a Tencent CTF configuration, with the competition token not actually injected. NorForge's reading is criminals reusing a toolkit. The report says there is no reason to believe Tencent ran the operation. The README on main separately records a Tencent Cloud hackathon result for the project. Those are two different sentences.

NorForge ran Trufflehog over the panel data. Hundreds of secrets, 11 percent verified valid. The panels also appear to expose administrative controls: start, stop, insert data, retarget, restart. NorForge did not test whether those controls work without authorization. This brief did not either.

NorForge says it checked one claimed intrusion at an unnamed hardware-parts vendor and found an uploader still present. It also says it validated one compromise at a very large US retailer and does not name the company. This brief does not repeat the paths.

The May tag and the October report.#

v0.1.0 published at 07:30 UTC on 3 May. The note calls it the first public release and says to use it only in explicitly authorized environments. v0.2.1 published at 06:50 UTC on 10 May and is still the latest release. Its note is dispatcher stability for large graphs. From 10 May to the 19 October report is 162 days. The repository advisory list is empty. There is no CVE.

main is 14 commits ahead of v0.2.1 and 0 behind. The tip is 15:22 UTC on 7 September, a documentation commit. None of the 14 subjects mention panel authentication. A merge at 17:31 UTC on 15 July adds a local execution mode for host-run workers. That commit is not in v0.2.1. The README on main says that mode runs agents with the user permissions and no sandbox. The v0.2.1 README does not contain that paragraph. This brief did not diff the mode.

The v0.2.1 disclaimer says Cairn supports penetration testing, CTF work, security assessment, and vulnerability research, and that it is intended only where the operator has explicit authorization.

Reuters, in the copy carried by RTE and updated 19 October, says Fagerland found about two dozen malicious instances beginning around 2 October, and that the report was provided ahead of publication. The report does not name victims. Reuters says it named them from its own review of the activity. The companies in that copy are Deere, SharkNinja, and Cummins, plus more than 100 companies in total, and more than 1,200 sites attempted. NorForge's project count and Reuters's site count are different units. Reuters says it could not ascertain how much data was taken.

Deere told Reuters it had taken remediation actions and had no indication sensitive information was accessed. SharkNinja said the hit was a standalone site with product support information and that the threat had been contained. Cummins said it was investigating a potential attack on a website operated by a third-party vendor. Two smaller businesses acknowledged being compromised. Other listed victims did not reply. Reuters also says one operator stole card data and another tried to have agents rob a cryptocurrency exchange. The Chinese-speaking operator, in the Reuters copy, began on 25 September. That date is Reuters's, not a line in the NorForge cluster section.

The author, handle le1xia0, acknowledged a Reuters message and had not answered the question list when that copy was written. Reuters quotes a post from the author: the platform is a multi-agent architecture and was not designed for hacking attacks, and harmful use was not the intention.

NorForge says it has been working with Reuters on victim notice and is trying to get the panels taken down. It is withholding panel addresses because many are still live and hold sensitive data. This brief does not list them.

1. 2026-05-03
   v0.1.0, first public release. Authorized use only, in the release note.
2. 2026-05-10
   v0.2.1, still the latest release. 162 days before the report. No advisory.
3. 2026-07-15
   Main gains a host-run worker mode. That commit is not in v0.2.1.
4. 2026-09-07
   Main tip. Fourteen commits ahead of the tag. No auth subject in the list.
5. 2026-09-25
   Reuters: the Chinese-speaking operator's activity begins. NorForge's cluster section does not use this date.
6. 2026-10-02
   Reuters: about two dozen malicious instances found from around this day.
7. 2026-10-19
   NorForge report. Reuters copy names Deere, SharkNinja, and Cummins. The report does not.

What to do.#

1. If you run Cairn, treat the panel as the control plane. An open board publishes the engagement, the findings, and anything a human pasted in, including when the goal was not met. Put authentication in front of it on a network you control. There is no patched tag in the release list for this.
2. If a client test ran on a panel you cannot show was authenticated, rotate every credential that could have reached the board, and tell the client the record may be public. NorForge's 11 percent figure is secrets that verified, inside hundreds it scanned. It is not a count of your engagement.
3. If you deploy main rather than v0.2.1, read the local-execution paragraph that the May tag does not have. The README says that mode runs with the user permissions and no sandbox. This brief did not diff the code.
4. If Reuters named your company, use the company's own statement for scope. Do not paste NorForge's unnamed hardware vendor, or its unnamed large retailer, onto Deere, SharkNinja, or Cummins. The report and the wire kept those apart.
5. Do not go looking for the panels. NorForge is withholding the addresses because the boards are still live and contain other people's secrets. Do not try the administrative controls on a panel that is not yours. NorForge did not, and neither did this brief.
6. Keep the three clusters separate. AIA0003 is low confidence. A single success rate, a single model, and a single dollar figure are how the reprints flatten a report that spent its length refusing those merges.