Inside Cairn: exposed AI hacking panels and a $5 task cost

Attackers are running AI agents against real websites, and some left their control panels open to the internet. On October 19, the security firm NorForge published what it saw in those panels, and Reuters ran a parallel report naming victims. The numbers are the news: a cost estimate of about $5 per task and an average success rate near 10%. This article separates what NorForge measured from what it inferred and from what Reuters added. It does not repeat the attackers’ prompts or techniques.

What did NorForge find in the exposed Cairn panels?

More than 20 open control panels that it assessed as likely malicious. NorForge searched Shodan and Censys for Cairn dashboards left open without a login, after a September Gambit Security report found AI harnesses on an attacker’s server. It grouped the panels into three clusters:

• AIA0001, Chinese-language, 14 panels, high confidence: over 1,100 attack projects against sites mostly in the US, Japan and Australia, aiming at lasting access to e-commerce and payment systems.
• AIA0002, English, 10 panels, high confidence: oriented toward financial theft, including payment data and cryptocurrency.
• AIA0003, English, 1 panel, low confidence: 59 projects, which NorForge says look more exploratory.

NorForge says all clusters appeared financially motivated and that it saw no obvious state-sponsored activity. It also found apparently legitimate red-team operations on exposed panels, which it says puts their clients at risk. It withheld panel addresses until takedowns are possible.

What is Cairn?

An open-source platform that NorForge describes as a state-based problem-solving engine. In its description, each task is a project with a start point and an end goal, and agents post what they discover (“facts”) and what they decide to do next (“intents”) on a shared board that a human can also add hints to. The platform itself is general purpose. Cairn’s author, who posts as le1xia0, told Reuters through a post on X that it was “not designed for hacking attacks.” The author acknowledged Reuters’ message but had not answered its questions, according to Reuters.

How much did these attacks cost, and how often did they work?

About $5 per task by NorForge’s estimate, and about one task in ten reached its goal. The $5 average includes unsuccessful and early-ending projects, and NorForge says it has no actual token counts and that the estimate could be off by a clear margin. Projects with over 1,000 facts and intents could cost more than $100, it says. NorForge puts the average success rate at around 10%, notes that the clusters had different goals and are not directly comparable, and says many other tasks reached partial goals.

For projects that did reach their goal in the busiest cluster, the average time was a little under 23 hours and about 140 facts per project, with one project running more than five days. Reuters, citing NorForge’s researcher Snorre Fagerland, reports roughly $5,000 worth of tokens for the campaign and about $50 per successful hack, which he called a rough estimate.

The two figures measure different things: per task versus per success. By our arithmetic they fit together, since $5 per task at a 10% success rate is about $50 per success, and $5,000 over 1,200 attempts is about $4 per attempt. That consistency does not make either number measured.

Which AI models were used?

Labels point to DeepSeek and Claude Code, but they prove little. NorForge says nearly all tasks in the busiest cluster ran on a worker named claudecode_deepseek-v4.1-flash, which “could mean” a Claude Code harness using DeepSeek’s V4.1 Flash model. The English-language financial cluster used a worker named pi_openrouter_deepseek, which NorForge reads as the Pi coding-agent framework using DeepSeek models through OpenRouter. Reuters describes the campaign as appearing to use a mixture of DeepSeek and Anthropic’s Claude Code. A worker name is a label chosen by whoever configured it. We found no statement from Anthropic or DeepSeek in the sources we read. Our own coverage of DeepSeek is of the V4.1-Flash-1017 checkpoint, and NorForge says V4.1 Flash was released in September.

Who was hit, and what do the companies say?

Reuters names three large companies and says it could not tell how much data was taken. NorForge’s report does not name victims. Reuters says it identified them by independently reviewing the hacker’s Cairn activity, and that its tally is more than 100 compromised sites out of more than 1,200 attempted by late last week. It names Deere, SharkNinja and Cummins. According to Reuters:

• Deere took “necessary remediation actions” and has “no indication that sensitive information was accessed.”
• SharkNinja said the hack hit a standalone site with only product support information and that the threat was contained.
• Cummins said it is investigating a potential attack on a website run by one of its third-party vendors.
• Two smaller businesses acknowledged being compromised, and other victims did not reply.

NorForge says it checked one claimed intrusion, at a hardware parts vendor, and the site served an uploader web shell. The Next Web notes it has not independently verified the intrusions.

What does this mean for defenders?

These are our observations, built on what NorForge and Reuters report:

• The panels leaked as much as they attacked. NorForge ran a secrets scanner over the panel data, found hundreds of secrets, and says 11% were verified valid.
• An open agent dashboard is a security issue for the people it targets, and for the operator, because NorForge says the panels appear to expose controls for starting, stopping and redirecting agents. It did not test whether those controls work without authorization.
• Red teams that use agent platforms need access control. NorForge calls publishing client secrets on an open panel a “nightmare scenario.”
• Ordinary weaknesses still do the work. In the case NorForge describes in detail, the agent chained an unsafe session store and unsafe deserialization, which are the kind of web basics that patching and review address.

What is still unknown?

• How much data was taken. Reuters could not ascertain it.
• The real model mix and token spend. NorForge has no actual token counts.
• Whether the success rate generalizes. It is a snapshot of a few clusters, and NorForge says models and harnesses evolve quickly.
• Whether the panels will come down. NorForge says takedowns depend on how hosters respond.
• Who is behind the campaigns. NorForge describes a Chinese-speaking actor and an English-speaking one by language and hosting only, and attributes nothing beyond that.

What to keep in mind

These are our observations:

• Do not mix the two cost numbers. About $5 is per task, about $50 is per successful hack, and both are estimates.
• A model label is a hint. The worker name suggests DeepSeek and Claude Code, but a label can be copied or misleading.
• The company responses are partial. Reuters reports them, and none confirms data theft.
• This follows earlier events. See the OpenCode Console breach and our agent incidents timeline for other agent-related security stories.

Editorial review: October 19, 2026 (AI). Prepared from NorForge’s report (full text, opened in a browser), Reuters’ report (full text, opened in a browser) and The Next Web (read through a summarizing fetch). We did not contact NorForge, Reuters’ sources or the companies, did not visit any panel or compromised site, and did not verify any intrusion. The article omits the attackers’ prompts, tool lists and technique details on purpose.