I'm a week late on the first half of this story. The second half dropped yesterday, and it's the part I can't stop thinking about: attackers who used AI agents to break into company websites left their agent control panels open on the internet, and then other attackers broke into those panels and turned the agents on their own hosts. Somewhere a pentester is laughing. Somewhere else a red team is rotating every key they own.
Part One: Agents Doing the Hacking
On October 19, the security firm NorForge published research on Cairn, an open-source AI tool built for authorized penetration testing. You give it a starting point and a goal, and AI agents work the problem step by step, posting findings to a shared board. Cairn's author told Reuters the tool "was not designed for hacking attacks."
Criminals used it for exactly that. NorForge found more than 20 exposed Cairn panels it judged likely malicious. The busiest cluster, a Chinese-language operation, tied 14 panels to more than 1,100 attack projects, mostly against online shops and payment systems in the US, Japan, and Australia. Reuters named companies including Deere, SharkNinja, and Cummins among the sites reached. Deere said it fixed the issue and saw no sign sensitive information was accessed. SharkNinja said a standalone support site was hit and contained.
The numbers that matter:
- About one in ten tasks reached its goal. That sounds low until you remember nobody's paying a human for the other nine.
- Successful break-ins averaged just under 23 hours. Nobody was sitting at a keyboard for those hours.
- The operator's instructions were tiny. Reportedly under 100 Chinese characters.
- The goal was usually a web shell uploader, a small form that lets the attacker come back later with something worse.
Credit to NorForge for being careful here. They point out that task counts aren't verified victim counts, and that the AI's own "success" labels aren't proof of compromise. That's the right way to report this stuff.
If this sounds familiar, it should. ThreatLabz documented the same pattern with ARTEX earlier this month (disclosure: I work at Zscaler). Open-source "pentest" frameworks with an LLM in the driver's seat are now a standard part of the criminal toolkit.
Part Two: Someone Hijacked the Hijackers
On October 26, NorForge published a follow-up. Starting around October 20, and possibly as early as October 10, automated campaigns went after exposed Cairn panels. At least 17 had malicious tasks inserted. Some panels belonged to criminals. Others belonged to red teams and capture-the-flag exercises.
The attackers didn't need an exploit. The panels had no authentication, so they just gave the agents new jobs:
- "Add this SSH key." One task told the agent to add an unknown public key to the
kaliuser's authorized_keys file. The agent did it. No questions asked, because that's what agents do. - "Go find the secrets." Tasks dumped environment variables and searched for API keys and tokens, and some wrote what they found into panel text that anyone viewing it could read.
- "Install this maintenance update." On October 21, a task deployed a Poseidon implant, a remote access tool from the open-source Mythic framework.
NorForge tracks two clusters. One focused on persistence and malware, the other on stealing credentials and finding more exposed panels. The tasking looked scripted, with possible human input at key points. NorForge says it doesn't know whether AI orchestrated the attacks, and couldn't confirm whether anyone escaped the container to the host. They observed passively and didn't touch anything.
Why This Matters to You
You're probably not running a criminal AI hacking operation. (If you are, wrong blog.) But you may be running an agent platform with a web dashboard, and this is what happens when it's reachable:
- The dashboard is the control plane. Whoever can reach it can tell your agents what to do, with your agents' permissions, on your infrastructure.
- Agents follow instructions. Adding an SSH key is a perfectly normal admin task. The agent can't tell a legitimate operator from someone who found the panel on a scan.
- Agent workspaces are secret magnets. API keys, cloud credentials, SSH keys. NorForge's earlier research found hundreds of secrets in panel data, and about 11% of the ones they checked were still valid.
This is the same lesson as the Skynet-mode LLMjacking agent from yesterday, from the other direction. Exposed AI infrastructure isn't a curiosity. It's a target, and the scanners are already looking for it.
What To Do
- Find your agent panels. Pentest harnesses, agent orchestrators, MCP servers, AI gateways. NorForge notes Cairn panels often answer on port 8000 with no login.
- Nothing agentic on the internet without authentication. Better yet, put it behind Zero Trust access so it isn't reachable from the internet at all.
- Keep production secrets out of agent workspaces. Short-lived, scoped credentials only.
- Contain the agents. Run tasks in isolated containers, block Docker socket access, and restrict outbound traffic to what the job needs.
- If you ran an exposed Cairn panel: rotate every API key it touched, check authorized_keys for entries you don't recognize, and look for the IOCs in NorForge's post.
- Hunt for stray upload forms on your web properties, especially in hidden directories. That was the foothold the criminal agents were after.
Bottom Line
AI agents are amazing at doing what they're told. That's the whole problem. If anyone on the internet can reach the thing that tells them what to do, they're not your agents anymore. Treat the agent control plane like a domain controller, because to an attacker, that's what it is.
Sources: NorForge: Automated Subversion and Attempted Takeover of AI Pentesting Harnesses, NorForge: Inside Cairn, The Hacker News on the original campaign, and GBHackers on the panel takeovers