Attackers hijack exposed Cairn panels to plant backdoors and steal API keys
Original title: Hackers Hijack AI Pentesting Agents to Install Backdoors and Steal API Keys
NorForge saw injected tasks on at least 17 panels add SSH keys, run Poseidon, and harvest model API keys.
NorForge says attackers injected tasks into exposed panels for Cairn, a platform that lets AI agents pursue goals on their own. Tasks added an unknown SSH key for the kali user, and on October 21 one task ran a base64 script that launched a Poseidon implant tied to the Mythic framework. Other tasks searched for API keys and wrote secrets into public panel facts. NorForge tracks clusters AIA0009 and AIA0010 and says only AIA0009 deployed malware. It advises isolating agent tasks, keeping panels off the internet, rotating exposed keys, and checking authorized_keys.
Unconfirmed: NorForge currently treats AIA0009 and AIA0010 as separate and has not confirmed that AI operated the campaigns.
- Activity was first seen on October 20, 2026, with earlier probing suggested.
- Similar injected tasks appeared on at least 17 exposed panels, including red-team and CTF systems.
- NorForge lists three defanged Poseidon command servers and one ELF SHA256.
- AstraRCE defaced many panels on October 20; NorForge treats that as separate.
- A separate September case used Cairn against retailers in 105 projects in one week.
Impact: Unauthorized SSH access, remote control, and stolen API keys
| Product | Affected |
|---|---|
| Cairn | — |
- 1.Do not leave Cairn panels open to the internet; run agent tasks in containers.
- 2.Rotate API keys that may have been exposed through the panels.
- 3.Review SSH authorized_keys files for unknown entries.
- Products
- Cairn
- Malware
- Poseidon
- Organizations
- NorForgeGambit Security
From the original article
4 min read at cybersecuritynews.com
Hackers are now targeting the AI tools that security teams use to test their own networks. A new investigation describes automated campaigns that break into exposed panels for Cairn, a platform that gives AI agents goals and lets them work on their own. Once inside, the attackers push new tasks into those agents.
By Tushar Subhra Dutta · cybersecuritynews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.