20+ exposed panels reveal open-source AI hacking agent Cairn in real cyberattacks
Hesamation · x · 2026-10-19
NorForge's investigation shows the open-source AI pentesting framework Cairn—give it a target and objective and it coordinates autonomous agents to recon, exploit, and persist—is being used extensively in real malicious cyber operations.
Key findings:
- 20+ Cairn panels exposed on the public internet without authentication (found via Shodan/Censys), offering a rare window into how threat actors pick targets, direct agents, exploit vulnerabilities, and maintain access
- Numerous legitimate red-team panels are also exposed, potentially endangering their clients
- In September, Gambit Security found AI harnesses including Hermes, Strix, and Cairn on an attacker's staging server in an e-commerce intrusion campaign
Hesamation: with open-source hacking agent frameworks now a reality, defense needs to pick up the pace.
More from coding & agent
- vLLM 0.32.0 adds structured-decision API reading first-token probabilities — AccBalanced · 2026-10-19
- 10 open-source GitHub repos for fully local speech-to-text, led by Whisper at 110K stars — victor_explore · 2026-10-19
- All Things Open talk: hardening agent security with Docker sandboxes — HowDevelop · 2026-10-19
- Nace AI launches Drex Max, a screenshot-in decision model for agents at 174 ms and $0.06/M tokens — testingcatalog · 2026-10-19
- Watch Claude Opus 5.5 build a game-ready bush via Blender MCP in 30 seconds — sidahuj · 2026-10-19
- Anthropic: Engineers' New Role Is Saying "No" to Claude — But Who Trains the Next Generation? — sqcai · 2026-10-19