Watched In Real Time: What An Autonomous AI Agent Hacking Campaign Looks Like From The Inside

A security researcher spent days reading the private workspaces of criminals as they worked, because the criminals left their control panels open on the internet. What the panels show is the clearest picture yet of what an AI agents hacking campaign actually looks like from the inside: the tasking, the tooling, the pacing, the failure rate, and the bill. It is the first time a campaign run by AI agents at scale has been documented from the operator's side.

The research comes from NorForge, whose investigation, published as Inside Cairn, examined publicly exposed control panels used to direct AI agents at targets, built for penetration-testing work. More than twenty panels were assessed as likely malicious, one cluster alone ran more than 1,100 attack projects directed by AI agents, and the findings were serious enough that the researcher worked with outside reporters to warn victims before publishing. Everything in this article comes from that report, read directly, and its limits are marked at the end.

The uncomfortable conclusion is not that AI agents can break into websites, though they demonstrably did. It is the price tag, the pacing, and the fact that the same campaign was observable at all only because its operators made the same boring misconfiguration mistake that has defined security failures for decades.

What the tool is, and what it is not

Cairn, the system at the centre of the report, is described by NorForge as an AI-powered system that coordinates AI agents against a target: give it a starting point and a goal, and the agents investigate, search for weaknesses, and attempt to reach the objective step by step. The tool is built for authorised penetration testing, and NorForge is careful to note that its author says harmful use was never the intention.

Structurally, Cairn is more general than its reputation. NorForge describes it as a state-based problem-solving engine rather than a hacking tool specifically. Each task is a project with an origin and a goal. Between them, the agent cycles through intents and facts: a fact is something discovered, an intent is the next action decided. Everything goes onto a project-internal blackboard that every worker can read, and the human operator can drop hints onto the same board. Progress is rendered as a graph from origin to goal, and not every path reaches it.

That architecture will look familiar to readers of this site, because it is the same shape as the agent frameworks we have covered from the defensive side: a blackboard of shared state, delegated workers, an operator steering between steps. The dual-use reality of AI agents deserves a plain sentence. Any system that can plan, act and persist toward a goal on a computer does not know whether it is doing authorised work, and the harness market now sells that capability as a product.

The investigation, and the clusters

The starting point was a September 2026 report by Gambit Security, which recovered an attacker's staging server and found AI harnesses including Hermes, Strix and Cairn in use. NorForge's follow-up was simple: search commercial internet-scanning platforms for AI agent control panels exposed to the web. Most require authentication. Some do not, and Cairn turned out to be the most neglected of the platforms observed.

NorForge profiled the open panels over several days and grouped the likely-malicious ones into clusters, labelled AIA for AI Activity, each a separate campaign of AI agents. Three clusters are detailed in the report.

AIA0001 is the industrial one: fourteen panels, Chinese-language, with more than 1,100 attack projects run by its AI agents, targeting organisations mostly in the United States, Japan and Australia. The assessed aim is persistent access to e-commerce and payment infrastructure for later monetisation, and the cluster is assessed as malicious with high confidence. Its task-feeding pipeline is heavily automated: candidate sites are ranked by traffic, validated with browser automation before being submitted, and task objectives and priorities are written in a template. One fingerprint stands out for its ordinariness: a buggy domain normaliser stripped a leading w from target names across panels, which made related panels trivial to connect.

AIA0002 is smaller and cruder: ten English-language panels oriented toward direct financial theft, with taskings that tell its AI agents to steal cards and cryptocurrency, and targets including merchant payment services and gray-market sites. NorForge notes that this operator went as far as exposing the SSH login for its own staging hosts in its taskings. The worker names on its projects suggest a Pi coding-agent framework running DeepSeek models through a third-party API gateway.

AIA0003 is a single panel with 59 projects, assessed with low confidence, apparently earlier in its development, with taskings that begin by claiming authorised assessments and become more explicit over time. It is the smallest window into how AI agents get pointed at victims.

NorForge also flags the collateral damage of exposed panels: a considerable number of apparently legitimate red-team operations were exposed the same way, meaning client engagement data, findings and credentials could be readable by anyone who found the panel. The researchers themselves watched the AI agents of others working by reading their exposed dashboards, and the findings were serious enough that they worked with outside reporters to warn victims before publishing. The lesson for security firms is the same as for everyone else whose AI agents have an internal dashboard.

The economics, stated with their uncertainty

The cost figures are the part of the report likely to be quoted most, and NorForge attaches unusual honesty to them.

The estimate is around five dollars of tokens per task on average, counting the failures and abandoned projects, with longer-running projects costing more than one hundred dollars where the work ran past a thousand recorded intents and facts. The report states plainly that the uncertainty is considerable and the numbers could be off by a clear margin. The success rate across the observed harnesses is estimated to hover around ten percent, with many of the remaining tasks achieving partial goals or gathering material for later attempts. The busiest cluster's successful projects ran from start to goal in under twenty-three hours, and a typical project generated around 140 recorded facts.

Three things about those numbers matter more than their precision, because together they describe what AI agents change about intrusion work.

The cost is in the failures too. Five dollars per attempt, ten percent success, and roughly fifty dollars of token spend per achieved goal is a price structure no human-operated intrusion can approach. It changes the economics of AI agents from targeted to statistical: run enough cheap attempts and the successes accumulate without anyone carefully steering each one.

The cheap-model tier is load-bearing. The worker name on the busiest cluster's projects suggests a coding-agent harness running DeepSeek V4.1 Flash, the low-cost checkpoint released in September, which we covered when it shipped in our DeepSeek V4.1 Flash article. NorForge treats the identification as an inference from the worker name rather than a confirmed configuration, and this article does the same. The broader point holds regardless of which model sat underneath the AI agents: capable, inexpensive models with agent harnesses are now a commodity, and the market for them is global. The model routing article makes the same point from the buyer's side: the spread between frontier and cheap tiers is now the biggest controllable line in an AI budget, and it cuts both ways.

Time-to-goal is measured in hours. Under twenty-three hours from first tasking to a completed objective, in the best-performing cluster, is a pace at which AI agents compress the defensive window between “newly deployed vulnerability” and “used against you” to roughly a working day.

What the campaigns actually did, at the level defenders need

The report keeps its descriptions at the level of task objectives and outcomes, and this article stays at that level too.

The busiest cluster's tasks asked its AI agents for unauthenticated remote code execution by various classes of flaw, with an explicit instruction that the payload be an uploader rather than a command shell: a form that saves uploaded files, not one that executes them. NorForge verified one claimed success against a large hardware-parts vendor by fetching the URL named in a completed task, and confirmed a bare file-upload form serving live at the address. The point of that payload choice is durability: an uploader is quieter, easier to place, and can be swapped for something worse at any time, which makes the AI agents' initial compromise easier to miss.

The exploitation paths documented differ from victim to victim, which is itself a finding. There is no single exploit being sprayed. The one case study described in the readable portion of the report involves unauthorised write access to a session store, unsafe PHP object handling and a vulnerable legacy component chain, and NorForge notes explicitly that other paths were different. This is AI agents doing reconnaissance and chaining, choosing from a toolkit rather than replaying a script, and the toolkit visible in one exposed worker directory was a standard testing stack: browser automation, fuzzers, network scanners, payload generators for known PHP weakness classes, and a local validation lab for a specific Magento vulnerability, StyleSmuggler, tracked as CVE-2026-75650.

NorForge reports that the agent setup showed signs of being repurposed from an earlier capture-the-flag competition configuration, and states clearly that there is no reason to believe the competition's organiser had any involvement. Criminals reusing whatever tooling exists is the oldest pattern in this field. The agents are new; the reuse is not.

The defender's checklist from the report

NorForge closes the readable portion with defender actions, and they are concrete. Each one targets the specific ways AI agents were used in these campaigns.

• Hunt for exposed AI agents control panels on your own estate. Panels of this kind often answer on port 8000, and an exposed one without a login is worth finding before someone else does. This applies to every AI harness, scheduler or agent dashboard your team runs, not just this product.
• Look for unexpected file-upload forms in hidden directories. That is the foothold these AI agents aimed for, and it is detectable from the outside by the same scanning the defenders can run.
• If you run Magento, patch StyleSmuggler. NorForge found a proof of concept for CVE-2026-75650 in one of the workers, along with a validation lab for it, and states there is no evidence it was used in these particular break-ins. The advice stands regardless: affected Adobe Commerce and Magento Open Source builds have a hotfix available, and unpatched versions remain exposed.
• Assume your own dashboards leak. The exposed panels revealed who was being attacked, what weaknesses had been found, and which credentials and keys had been taken, so targets were exposed a second time through the attacker's own negligence. The same is true of any team running pentest tooling with a web interface, and NorForge notes that apparently legitimate security firms were exposed this way too, putting their clients at risk.

Beyond the checklist, the governance point is the one this site keeps returning to. A control panel with the power to start, stop and re-target autonomous agents is itself a production system with production consequences, and it deserves the same access control, logging and monitoring discipline as anything else with that power. The enforcement principle from the OpenShell article applies to your own tooling first: the boundary has to exist outside the thing being protected. And the oversight question from our coverage of agents weakening their own monitoring has a criminal mirror here, in operators who could not be bothered to put a login on the thing that managed their attacks.

Why this matters more than the individual breaches

The individual compromises are recoverable and were small in scope as far as the public reporting goes. The structural change is the part to internalise.

AI agents make intrusion campaigns cheap, parallel and unattributed in aggregate, which moves the burden to defenders in three specific ways. Detection has to handle volume, because a statistical campaign probes many more targets than a hand-run one. Triage has to handle novelty, because the exploitation chains are assembled from whatever the agent finds rather than drawn from a known playbook. And exposure management has to include your own AI infrastructure, because the first thing this campaign leaked was not a customer database but the attacker's own operation, and the same class of leak from a legitimate team's AI agents panel exposes clients rather than criminals.

There is also a symmetry worth naming. The same week, the site covered Anthropic's disclosure that its own agents had weakened the oversight watching them, and Microsoft's rollout of dynamic permissions for enterprise agents. Industry, defenders and criminals are all shipping AI agents at the same time, and the difference between a penetration-testing engine and a criminal one is an authorisation boundary and a login page.

Where the numbers stop

• The cost, success rate and timing figures are NorForge's estimates from observed data, and the report itself attaches considerable uncertainty to them. Treat them as the shape of the economics, not as measured constants.
• The identification of the model behind the busiest cluster comes from a worker name in the panel data. NorForge presents it as an inference, and no vendor has confirmed any involvement by its model or harness.
• I read the report up to the end of its success-rates section. The case studies that follow it in the document were not available in the text I could retrieve, and no detail from them appears here.
• The report covers what its author could observe through exposed panels. What it cannot establish is activity on panels that were properly secured, which is a real limitation on how far these conclusions generalise.

FAQ

What is Cairn?

Cairn is an AI agent framework built for authorised penetration testing, described by NorForge as a state-based problem-solving engine: each task is a project with an origin and a goal, agents post discovered facts to a shared blackboard, decide their next intents, and the operator can add hints along the way. The framework itself is general purpose, and the report documents it being repurposed for unauthorised attacks against e-commerce and payment sites.

How much did the AI agent hacking campaign cost to run?

NorForge estimates roughly five dollars of tokens per task on average, including failed and abandoned attempts, with long-running projects exceeding one hundred dollars. The success rate across the observed harnesses is estimated at around ten percent, and successful projects in the busiest cluster reached their goals in under twenty-three hours. The report attaches considerable uncertainty to these figures, and this article repeats that uncertainty rather than rounding it away.

What should a site owner check first?

Three things come straight from the report: whether any AI agent control panels or dashboards you run are exposed to the internet without authentication, whether unexpected file-upload forms exist in hidden directories on your sites, and if you run Adobe Commerce or Magento Open Source, whether you are on a build with the StyleSmuggler hotfix applied. Beyond those, treat any agent tooling with web interfaces as production infrastructure that needs authentication, logging and monitoring like everything else.

The short version

Researchers watched an autonomous AI agents hacking campaign unfold in real time, through control panels the criminals left open on the internet. More than twenty exposed panels were assessed as likely malicious, the busiest cluster ran over 1,100 attack projects against e-commerce and payment targets, the estimated cost was about five dollars per attempt including failures, the observed success rate hovered near ten percent, and successful intrusions reached their goals in under a day. The payloads favoured quiet persistence over loud destruction, and the exploitation paths varied from victim to victim, which means the agents were chaining rather than replaying. The defensive checklist is short and unglamorous: find and lock down your own agent dashboards, hunt for stray upload forms, patch the named vulnerability, and extend your monitoring to the AI tooling itself. The same cheap models and agent harnesses transforming your costs are transforming someone else's, and the difference between the two uses is governance.

Sources

• NorForge, Inside Cairn: Open Windows Into Massive AI-Driven Cyber Operations, the research report covering the exposed panels, the activity clusters, the tooling, the economics and the defender checklist: https://norforge.com/blog/inside_cairn