NorForge finds more than 20 open panels of the Cairn AI tool

NorForge, a security firm, looked for open panels of Cairn on the internet. Cairn is an AI system. It tells software agents to find weak points in a target and try to go into it. NorForge found more than 20 panels that it connects to crime. One group has more than 1100 attack projects. The panels also show data of targets.

How it works

In Cairn, each task is a project with a start and an end goal. The agents write each fact that they find on a board for all agents. A person can add hints to the same board.

The numbers

NorForge tells that the primary group, AIA0001, uses 14 panels and Chinese. It points at online shops, most of them in the US, Japan and Australia. NorForge thinks the goal is access to payment systems. It thinks all groups want money. It saw no sign of state actors.

What is not known

NorForge did not give the addresses of the panels, because the data shows targets, weak points and keys. It tells only that a large number of legitimate test teams are also open. It gave no count.

Insight: Attackers and test teams make the same mistake

In September 2026, Gambit Security found Cairn on a server of attackers. NorForge finds that criminals and legitimate test teams keep panels open. Cogent tells that its study found 3 new attack paths for AI agents and 1 for an attacker who is a person. This reads as a race. The tools go to users before the rules to keep them closed, and the weak point is the user.