Security firm NorForge stumbled upon something online that should never have been visible. More than twenty control panels for Cairn, a tool through which cybercriminals direct artificial intelligence during attacks on online stores, were freely accessible to anyone. Researchers were thus able to literally look over the attackers’ shoulders as they selected victims, assigned tasks to automated systems, and watched these bots independently search for vulnerabilities and break into other people’s networks.
The trail began in September, when cybersecurity company Gambit Security described a campaign targeting online marketplaces. On a server that served as the attackers’ base of operations, it found several programs using artificial intelligence, including Cairn. Such software usually has a web interface, and people often leave it completely unsecured.
NorForge researchers therefore tried the Shodan and Censys search engines, which scan devices connected to the internet. Most of the interfaces they found required a login. But not all of them. Cairn appeared to be the most neglected. At first, only a few open-access instances appeared, but more were quickly added. Moreover, the language, targets, and instructions used made it clear that many of them belonged to the same groups.
How an AI Hacker Thinks
Cairn is usually described as an autonomous penetration-testing tool, meaning it tests whether a system can be breached. In reality, it can solve problems step by step in general. It is given a starting point and a goal, then finds its own path to reach it.
Each task forms a separate project. While working, the virtual agent alternates between two activities. It either discovers something, which Cairn calls a fact, or decides what to do next, which it labels an intention. It records all findings on a shared board used by the other agents working on the same task. The person directing the operation can also add advice there. The program then depicts the entire process as a branching map, where some paths lead to dead ends and others all the way to success. One such graph ended with a report that a major US retailer had been successfully compromised, with the attackers planting a hidden remote-access tool on its website.
Thousands of Attacks at Once
The researchers divided the attackers into groups designated by the abbreviation AIA. The most active of them, AIA0001, communicates in Chinese and controls fourteen interfaces containing more than 1,100 attack projects. It primarily targets online stores and payment systems in the US, Japan, and Australia. It does not steal immediately; it seeks to establish persistent access that it can monetize later.
The group has largely automated its work. A typical assignment for the artificial intelligence states that the targets are verified stores in the US, Canada, Japan, and Australia with traffic ranging from 200,000 to 1.5 million users. The system is tasked with finding a way to execute its own commands on the server without logging in. Before a website even reaches the actual analysis stage, another program tests whether goods can genuinely be ordered from it.
The automation also has its flaws. Many targets are missing the letter w at the beginning of their names, turning the English word wholesale into holesale. This is most likely caused by faulty code that removes one extra letter when stripping the www prefix. This made it easier for the researchers to find other websites belonging to the same group.
On one occasion, the working directory of one of the virtual agents briefly became accessible to the attackers. The researchers found a collection of common hacking tools for scanning networks, guessing passwords, and controlling browsers. One of the messages then revealed that the environment came from an ethical hacking competition organized by Tencent. According to NorForge, the criminals had merely recycled a ready-made configuration, and Tencent had nothing to do with the attacks. The tasks were handled by software bearing a designation suggesting that it combined the Claude Code tool with the inexpensive Chinese DeepSeek 4.1 Flash language model.
The second group, AIA0002, writes in English and goes directly after money. Its ten panels openly discuss stealing payment cards and cryptocurrencies. Many projects contain no technical instructions, only brief commands such as get cards or get cryptocurrency. The attackers leave the rest to the AI. They target payment services, dubious websites, and online pharmacies. The victims even included a portal that itself trades in stolen cards. Several African stores among the targets suggest that the perpetrators may be operating from Africa. They use Cairn not only to attack websites, but also, for example, to transfer money between cryptocurrency wallets. The systems are again powered by DeepSeek models, this time through the OpenRouter service.
The third group has a single panel containing 59 projects. Although their assignments claim to be authorized tests, they gradually begin openly requesting access to servers, administration panels, or databases.
Cheap Attacks and Passwords on Display
According to experts, the attacks have a success rate of around ten percent. Many other attempts achieve at least partial success or yield information for the next round. For the AIA0001 group, the successful journey from assignment to objective took an average of just under 23 hours, during which the system accumulated roughly 140 findings. The longest project ran for more than five days.
Money is not an obstacle either. According to NorForge’s estimate, an average operation costs around five dollars, while the most demanding projects involving more than a thousand steps can cost over one hundred dollars. The analysts admit that the estimate is highly uncertain, but it is inexpensive in any case.
They verified for themselves that this was not merely theoretical. They opened an address that the software listed for a completed breach of a major computer-parts retailer and indeed found a file-upload form there. The attackers can replace it with something far more dangerous at any time.
Unprotected interfaces harm victims twice over. They reveal not only that someone is attacking a website, but also everything the artificial intelligence discovered along the way, as well as passwords entered from previous thefts. A secrets scanner found hundreds of access keys in the data, 11 percent of which were demonstrably functional. The problem does not affect criminals alone. The researchers also encountered legitimate security teams that had left their clients’ tests on similarly open pages.
These panels also appear to provide full control. In theory, anyone could launch and stop operations or redirect the bots to a completely different target. For obvious reasons, the researchers did not attempt this. They shared their findings with the Reuters news agency, with which they are now alerting compromised companies and trying to have the servers shut down. Whether they succeed depends primarily on how quickly web-hosting providers respond.
Source: norforge.com
