NorForge's Cairn Report: Exposed AI Agent Dashboards Leaked Targets and Secrets. What Builders Should Take From It

A security firm says it found more than 20 unprotected control panels for an AI-driven hacking harness, and that the panels leaked their operators' targets, instructions and credentials. For builders the lesson is not about the attackers. It is about what any agent dashboard exposes if you leave it open.

This article summarizes the October 19 NorForge report, Inside Cairn: Open Windows into massive AI-Driven Cyber Operations. It is a single vendor's research. The Rundown AI newsletter said Reuters identified victims, but I did not check Reuters, so I rely on NorForge's own text. I am leaving out operational detail such as exploit tooling, and I did not visit any panel.

What NorForge reports

According to the report:

• Cairn is described as an AI-powered system that, given a target and an objective, coordinates AI agents to investigate, look for weaknesses and try to break in.
• NorForge found open Cairn panels through internet-scanning search engines. It identified more than 20 that it assessed as likely malicious, plus a considerable number of apparently legitimate red-team panels exposed the same way.
• It grouped the malicious panels into three activity clusters. The largest, which it calls AIA0001, had 14 panels and over 1,100 attack projects, with a focus on e-commerce and payment infrastructure. NorForge says all clusters appeared financially motivated and it saw no obvious state-sponsored activity.
• Panel contents included target lists, agent task updates and human-entered hints.
• NorForge says it is cooperating with Reuters to notify victims and trying to get panels taken down, and it withheld panel addresses for that reason.

Numbers the report gives, with its caveats

• Average success rate across the harnesses it saw: around 10%, with many other tasks reaching partial goals or gathering information for later attempts.
• For the largest cluster, tasks that did reach their goal took a little under 23 hours on average from start to goal, with about 140 facts recorded per project. One project ran more than five days.
• Cost: NorForge says it has no token usage numbers and estimates an average task at around $5, with longer projects possibly over $100, and says the uncertainty is considerable.
• Credentials: running a secrets scanner over panel data, NorForge says it found hundreds of secrets, with 11% verified valid.

NorForge also says the snapshot is point-in-time and that models and harnesses evolve quickly. On the models, it says the workers' names could mean a Claude Code harness using DeepSeek 4.1 Flash, and another cluster used a Pi harness with DeepSeek models through OpenRouter. Those are inferences from worker labels, not confirmed facts. They say nothing about the vendors' intent, and I would not read them as a model ranking.

What the exposure itself shows

The report's own conclusion is about operational security. NorForge says attackers rushed and left dashboards open, which exposed their own operations and also exposed their targets to a larger attack surface. It says the same problem hit legitimate red teams: putting client findings and secrets on an open panel is a serious issue even when the test result is harmless.

It also says the panels appeared to expose what looks like full administrative control of the harness, including starting and stopping projects, redirecting agents and restarting old projects. NorForge says it did not test whether those controls work without authorization.

Lessons for people running agents

These are my own suggestions, drawn from the report's themes. They are untested.

1. Treat any agent control panel as high-risk. Per the report, a panel can hold the full record of what the agent found, plus the credentials humans pasted in. Put it behind authentication and keep it off the public internet.

2. Assume the log is a secret store. If humans type tokens and keys into task descriptions, those end up in the dashboard and the logs. Use scoped, short-lived credentials where you can, and scan your own logs for secrets.

3. Scan your own exposure. The report found these panels with ordinary internet scanners. Check what your own hosts expose.

4. Separate control from view. A read-only view is much less risky than one that can restart or redirect agents.

5. Limit what an agent can reach. The report is a reminder that capable agents with broad access make a compromised control plane more dangerous.

6. Keep client data out of open tools. Red teams in particular should not run client engagements on unauthenticated panels.

What I would not conclude

• That any model or vendor is to blame. The report infers models from worker names.
• That a 10% success rate is low enough to ignore. At the scale NorForge describes, that is a lot of attempts, and it also says many other tasks produced partial results.
• That these numbers describe all AI-driven intrusion. It is one researcher's view of panels that happened to be open.
• That the cost estimate is reliable. NorForge itself says it could be off by a clear margin.

Frequently asked questions

What is Cairn?

Per NorForge, an AI-powered system that coordinates agents to investigate a target, look for weaknesses and try to break in, using a project model with an origin, a goal and a shared record of facts.

How did NorForge find the panels?

It says it used internet scanning search engines such as Shodan and Censys.

How many panels were malicious?

More than 20 were assessed as likely malicious, in three activity clusters, according to the report.

What was the success rate?

About 10% on average for the harnesses it saw, with many remaining tasks reaching partial goals, per NorForge.

Were credentials exposed?

NorForge says hundreds of secrets were found in panel data, with 11% verified valid by a secrets scanner.

Did NorForge access the panels' controls?

It says it did not test whether the admin controls work without authorization, and did not log into the attackers' servers.

What should I do with my own agent dashboards?

Put them behind authentication, keep secrets out of task text where possible, and check what is publicly reachable.

Sources

• NorForge, Inside Cairn: Open Windows into massive AI-Driven Cyber Operations (October 19, 2026): all claims about the research. Read in full except the case studies and indicator tables, which I skimmed.
• The Rundown AI, October 20 issue: discovery pointer only.