AI Hacking Agents Are Breaching Real Websites — and the Criminals Left Their Own Dashboards Wide Open
Security startup NorForge discovered more than 20 publicly exposed, password-free dashboards for an AI hacking tool called Cairn, revealing over 1,100 attack projects targeting online stores across the US, Japan, and Australia. The findings show AI agents autonomously breaching real businesses at an estimated cost of around $5 per attempt, with roughly 10% of projects succeeding — while the criminals behind the operation ironically left their own command centres completely unsecured.
Cybersecurity researchers have long warned that AI agents — software that browses the web, runs code, and takes autonomous actions — would eventually be weaponised by criminals. That future has arrived. According to reporting cited by The Neuron, a security startup called NorForge has found more than 20 exposed control panels belonging to an AI hacking tool called Cairn, and what those panels reveal is both alarming and, in a darkly comic twist, deeply embarrassing for the attackers who left them open to the entire public internet.
What Is Cairn, and How Does It Work?
Cairn is best understood as a coordinated team of AI workers sharing a digital whiteboard. You give the system a target — say, a specific online store — and a goal, such as finding a way in. That job becomes a project. As the agents work, they post what they have learned (facts) and what they plan to try next (intents) onto the shared board. A human operator can add hints at any point. Because the board retains a full memory of everything that has happened, a single project can run continuously for hours or even days without needing a human to babysit it.
This is a meaningful leap beyond simple automated scanning tools. Cairn is not just checking a list of known vulnerabilities and moving on. It is reasoning, planning, and iterating — much like a human penetration tester would, but at machine speed and with no need for sleep.
What NorForge Actually Found
NorForge, a startup that builds sandboxing tools for AI agents, discovered more than 20 of these Cairn dashboards sitting open on the public internet with no password protection whatsoever. Anyone who stumbled across them could read everything: target lists, the agents’ running notes, and stolen login credentials.
The numbers that emerged from those panels are striking. One cluster of 14 dashboards, driven by Chinese-language instructions, contained more than 1,100 attack projects. The targets were concentrated primarily in online stores based in the United States, Japan, and Australia. NorForge estimates that roughly 10% of projects hit their goal — and within that successful cluster, the average time from start to finish was just under 23 hours.
The cost side of the equation is equally sobering. NorForge’s rough estimate puts a typical attempt at around $5 (approximately ₹425) in AI model fees, once failures are factored in. If you apply the 10% success rate to that figure, you arrive at a ballpark cost of about $50 (roughly ₹4,250) in model fees per successful breach. That is not a precise figure — The Neuron notes it is the publication’s own back-of-the-envelope calculation — but even as a rough order of magnitude, it signals that the barrier to running large-scale AI-assisted hacking campaigns has dropped to a level that should concern every business with an online presence.
The Verge, as cited in The Neuron’s reporting, identified named targets in the panels, including well-known companies such as John Deere, SharkNinja, and Cummins. One operator appeared to have compromised more than 100 sites. NorForge verified at least one claimed breach: it checked a large hardware parts vendor and found the back door — a hidden page allowing attackers to upload files directly to a server — still live and accessible on the vendor’s website at the time of discovery.
Scanning the exposed data turned up hundreds of passwords and access keys. Critically, 11% of those credentials were still valid at the time NorForge examined them.
The Irony That Defines This Story
Here is where the story takes a turn that would be funny if the stakes were not so high. The criminals operating these AI hacking campaigns, sophisticated enough to run more than 1,100 coordinated attack projects against businesses across three countries, forgot to put a password on their own command centres.
NorForge could walk in and read everything. One group even posted the login credentials for its own staging server inside its exposed dashboard. A bug in another group’s pipeline was mangling website names — dropping the leading letter “w” from domains, turning “wholesale” into “holesale” — which inadvertently made that cluster’s panels even easier for researchers to identify and track.
This is a useful reminder that even technically capable threat actors make operational security blunders. But the more important lesson is not to be reassured by their carelessness. The tools themselves work. The success rate, even at NorForge’s conservative 10% estimate, represents real businesses with real breaches. The attackers’ sloppiness gave researchers a window into their operations — it did not stop the attacks from happening.
What Models Were Powering the Agents?
Worker names visible inside the panels suggest that the agents were built on top of off-the-shelf coding agent frameworks, and NorForge’s reading of the evidence points to DeepSeek’s V4.1 Flash model as the likely engine. The Neuron is careful to note that this is NorForge’s interpretation, not a confirmed fact. If accurate, it is a notable detail: cheap, widely accessible models are sufficient to power a sustained, multi-project hacking operation at scale.
What This Means for Businesses in India and Beyond
If you run a website, an e-commerce store, or any kind of customer-facing portal, the lesson from Cairn’s project lists is uncomfortable: the agents are not going after exotic, deeply hidden vulnerabilities. They are systematically working through the boring stuff — login page weaknesses, pages that skip authentication checks entirely, and insecure file upload functionality. These are old, well-documented classes of vulnerability. The difference is that AI agents can now work through more than a thousand such projects in a single cluster, dramatically compressing the time between a vulnerability existing and it being found and exploited.
For Indian businesses — particularly the fast-growing base of e-commerce platforms, fintech portals, and SaaS companies — this threat is not abstract. The targeted geographies in the exposed panels were US, Japan, and Australia, but the economics that make AI-assisted hacking attractive do not respect borders. A ₹4,250 cost per successful breach is viable for attackers targeting almost any market.
Practical Steps Worth Taking Now
- Audit your login flows. Check that every page in your application actually enforces authentication. Missing an auth check on a single admin page is exactly the kind of flaw these agents are hunting.
- Review file upload functionality. Unrestricted file uploads are a classic entry point. Ensure uploaded files cannot be executed on your server.
- If you use external red teams (hired security testers), ask how they secure their own AI dashboards. NorForge found that apparently legitimate red-team setups were also left exposed — which means a client’s sensitive data could leak from the tester’s infrastructure, not just the target’s.
- Rotate credentials regularly. With 11% of stolen credentials still valid at the time of NorForge’s review, the window of exposure from a past breach can be longer than you realise.
What to Watch Next
The Neuron reports that NorForge is working with Reuters to notify victims and is attempting to get the exposed panels taken down, though that depends on the cooperation of the hosting companies involved. The more consequential question is forward-looking: NorForge’s 10% success estimate reflects the current capability of these models and agents. As the underlying AI improves — and it is improving rapidly — that success rate is likely to climb. The cost, already low, may fall further.
The Cairn dashboards offer a rare, unintended transparency into a world that normally operates in the dark. The picture they reveal is of AI-assisted hacking that is already operational, already targeting real businesses, and already succeeding — not every time, but often enough to matter, and cheaply enough to run at scale.
The attackers left the door to their command centre wide open. The question every business should now be asking is whether their own doors are equally unguarded.
