The Panel Became the Payload: Attackers Subvert Exposed Cairn Harnesses to Plant SSH Keys and Steal API Tokens

2026-10-27 Agent & Supply Chain Security by al-ice.ai Editorial

A week ago this site covered criminals using exposed Cairn panels as intrusion infrastructure (the agent army behind 100+ intrusions). Now the same researcher reports the inversion: unknown actors are breaking into the exposed panels and turning the victims’ own agents against their hosts. In “Automated Subversion and Attempted Takeover of AI Pentesting Harnesses,” published 26 October 2026, NorForge researcher Snorre describes systematic, highly automated campaigns that began in earnest on 20 October — injecting agentic tasks that profile the harness, install attacker SSH keys, steal model API keys, and download malware. At least 17 exposed panels received the injected tasks, and not all of them belonged to criminals: some appear to be red-team and capture-the-flag rigs.

The mechanism is Cairn’s own design reflected back at its operators. A Cairn panel exposes goals, origins and the fact-graph of everything agents learn — and anyone who can reach it can start tasks, stop them, and read every finding previous tasks uncovered. The attackers simply walked in as boss. The first wave arrived as 11 tasks on a panel previously associated with the AIA0002 intrusion cluster, formatted differently from anything before: random hexadecimal strings in the titles, all pointed at the local Cairn host rather than external targets. One was named “Install kali SSH key” and carried an exact bash recipe — create /home/kali/.ssh with mode 700, append an attacker ed25519 key to authorized_keys, set ownership and mode 600 — and the agent did as it was told, then posted its own verification back into the panel. The malicious tasks then vanished while the researcher watched, leaving only an incremented project counter. The same task shapes turned up on unrelated panels within hours.

Two clusters, one scanning backend, no shared fingerprints

NorForge tracks the activity as two clusters, AIA0009 and AIA0010, while stressing the split is provisional. AIA0009 uses random-suffix task names (“Local worker maintenance 2b12ea848a8b2d4c”) and tags its probes “cairnscan,” which reads as backend-driven scanning for Cairn instances; it handles persistence, access and malware. AIA0010 mimics Cairn’s own intent labels (“i014”), leans exploratory — internal services, credentials, agent infrastructure — and uses compromised agents to scan selected IP ranges for further exposed panels, so the population of victims recruits the next wave. Wording overlaps, but NorForge found no shared hard indicators and treats them as separate groups pending new data. The waves land in tight synchronisation across unrelated panels, which makes the campaigns scripted at minimum; the open question — stated as a question, not a finding — is whether one or both are AI-orchestrated, which would make this humans using AI to deliberately attack someone else’s AI operation.

The reconnaissance predates the visible campaign. NorForge found suspect recon tasks as early as 10 October on a panel belonging to a likely legitimate pentester — five consecutive “recon-host-escape-*” jobs interrogating the agent workspace for container-escape material. Later AIA0010 tasks are explicit about the prize: one quoted in full pipes id, hostname, the sorted environment, PID 1’s command line, listeners, Cairn file listings and a recursive grep for ANTHROPIC_AUTH_TOKEN, CAIRN_AUTH, DISPATCHER and API_KEY straight into a panel fact — and facts are public to anyone viewing the panel, so secrets are exfiltrated by publishing them. The attackers are also intensely interested in the container boundary: capabilities, mounts, Docker sockets, SSH credentials, cloud metadata and admin interfaces. NorForge could not confirm a completed escape, and notes the distinction that matters: containerised tasks cost the attacker their foothold when stopped, while a Cairn running directly on the host hands over everything.

The malware: Poseidon via Mythic, hash-checked, stop-file persistent

On Wednesday 21 October at 21:15 UTC, a task on “panel 51” told the agent to decode a base64 blob and pipe it to a shell. The script created $HOME/.local/libexec, downloaded a Linux x86-64 binary over HTTP from port 28471, verified it against SHA-256 1cfee868…fa4fa43 before executing — operational hygiene, not smash-and-grab — launched it detached under the name worker-health, and then looped forever until a stop file appears, keeping the agent workspace alive so the implant outlives the task. The binary is Poseidon, a Go remote-access trojan managed through the open-source Mythic red-team framework, configured against a Bunny.net CDN hostname. Server logs show a localhost HEAD check three minutes before the first fetch task, then the campaign paused, configured malware and stood up infrastructure, then resumed — the human-shaped gaps that keep the “fully autonomous” claim honestly unproven. A likely second malware round was observed, but by then the download server had gone dark. Only AIA0009 has been seen deploying malware.

There is an attribution-shaped hole worth naming plainly. The defacements that hit many Cairn panels on the 20th — handle AstraRCE — were vigilante vandalism, explicitly separated by NorForge from what followed, and conflating the two would manufacture a single actor out of three. What survives that separation is the structural finding, and it is the one defenders should budget around: an agentic system’s control plane is an attack surface other agentic systems can work. NorForge’s own closing question — what surfaces are agentic systems introducing that nobody has thought through, and how will other agentic systems exploit them — is the right frame, and this incident is the first field data point for it rather than the last. The same exposure this site flagged a week ago as a breach-disclosure document is now also a remote-access vector into the operator, including operators doing legitimate red-team work.

No CVE is assigned; there is no vendor defect, only unprotected deployments of a dual-use harness. NorForge’s remediation is exposure removal plus hygiene: secure Cairn panels now, run agent tasks containerised inside strict boundaries, never leave panels internet-reachable, rotate any possibly exposed API keys, and review authorized_keys for unknown entries. Published indicators, defanged per the report: C2s 103.181.134[.]12, 199.91.220[.]129 (the malware host), 64.176.50.179, Bunny CDN C2 74342459543956677599003426txhdpndwdwy.b-cdn[.]net, and implant SHA-256 1cfee868e5e488bb862140cf288fce46a167aa5982900102356dac552fa4fa43. Treat any panel that was ever exposed as compromised until proven otherwise — the campaign also harvested credentials into public fact texts, so the blast radius includes every key the agents could see, not just the hosts they ran on. Compare the sibling pattern in the AgentCorruption chain, where a single prompt reached API keys, OAuth tokens and Secrets Manager material: the agent’s legitimate access remains the softest path to the crown jewels.

Our verification was read-only. The campaign facts — the 26 October 2026 NorForge blog and its contents (AIA0009/AIA0010 naming, the cairnscan tag, the iNNN convention, 20 October start with 10 October recon precursors, the 11-task wave, the kali SSH-key task and agent compliance, 17+ panels including red-team/CTF rigs, synchronised bursts with human pauses, the 21 October 21:15 UTC Poseidon/Mythic delivery with hash check and stop-file persistence, the Bunny CDN C2, the container-escape probing without confirmed escape, the AstraRCE defacement separation, the passive-observation disclaimer and the IOC list) — were read first-hand from the full norforge.com text; the 27 October 2026 secondary writeup was used only for publication-timing corroboration. No Cairn panel was accessed, no agent was tasked, no binary was downloaded or executed, no indicator was resolved, no vendor was contacted; no request was sent beyond reading the cited public pages. Brave Search was used for discovery only.

Sources: