NorForge reported finding more than 20 exposed Cairn panels it assessed as likely associated with malicious activity in an investigation published October 19, 2026. The findings offer a separate view of the reported AI-agent website campaign: exposed operator dashboards could reveal project details and credentials, while one task included a shell URL NorForge said it checked and found live.
What the exposed panels revealed
NorForge identified more than 20 panels it considered likely linked to malicious activity. It also found exposed panels associated with apparently legitimate red-team operations, which could put those teams’ clients at risk if project details or credentials were exposed.
NorForge describes Cairn as a state-based problem-solving framework. Its agents record discoveries on a shared project board, where information from earlier steps can guide later work. The panel findings concern the systems operators used to manage projects, alongside the websites targeted in the reported campaign.
AIA0001 and exposed panel data
NorForge attributed more than 1,100 attack projects across 14 dashboards to a Chinese-language activity cluster it labeled AIA0001. It assessed the cluster as malicious with high confidence. The project count describes activity associated with those dashboards, not the number of websites reported as targets in the campaign.
NorForge also reported that a Trufflehog scan found hundreds of secrets in exposed panel data, with 11% verified as valid by the tool. That result concerns credentials and other secrets in the panels. NorForge said successful projects, particularly those associated with AIA0001, averaged 140 recorded facts apiece.
Across the harnesses it observed, NorForge estimated an average success rate of about 10%, while noting that the clusters pursued different goals. For relevant projects that reached their goals, elapsed time from project start averaged just under 23 hours. One observed project ran for more than five days. These are estimates from NorForge’s panel investigation, not campaign-wide rates or timings.
One task included a live webshell
In a case study, NorForge said it checked a shell URL listed in a completed Cairn task at a large hardware-parts vendor and found a live uploader webshell. The observation concerns that specific URL and task.
How the campaign figures differ
Reuters reported more than 1,200 attempted website intrusions and more than 100 reported compromises. The first number counts attempted intrusions; the second counts reported compromises. Reuters also described an alleged Chinese-speaking operator using instructions of fewer than 100 Chinese characters.
The campaign figures count attempted intrusions and reported compromises. NorForge’s panel investigation tracks exposed dashboards, projects, panel data and one checked shell URL.
