Observed incident

Exposed Cairn panels reveal agent-driven retail intrusions

Reported

Published here

What happened

NorForge found more than 20 likely malicious Cairn panels coordinating autonomous intrusion attempts, primarily against commerce and payment systems. It independently validated selected compromises, including a live uploader webshell.

Parties and reporting

AI tools and systems: Cairn agent orchestration, Playwright, Unconfirmed underlying language models

Outcome

Reuters reported Deere remediation without indicated sensitive-data access, SharkNinja containment of a support-site incident, and Cummins investigating a possible vendor-site attack. Wider data loss and complete panel takedown remain unconfirmed.

Operating lesson

Patch internet-facing commerce systems, hunt for persistent web access, restrict exposed secrets and authenticate agent control panels.

Evidence and limits

Multiple activity clusters, not one attributed campaign. Worker names only suggest model choices; language does not establish nationality. NorForge's success-rate and cost estimates are not verified totals. Reuters updated October 20; earliest verified publication is October 19.

Sources