The Open Panel

On the 19th of October 2026, Reuters reported that a Chinese-speaking hacker had used an open-source AI platform called Cairn to break into more than 100 websites, including Deere, SharkNinja and Cummins. The agents did almost all of the work. A researcher watched through the attacker's own control panel, which was open to the internet.

Key · companies amber, places red

Snorre Fagerland did not break in. He went looking for open doors. From the 2nd of October, the NorForge researcher scanned for reachable Cairn servers, found about two dozen, and watched. One operator ran a campaign against more than 1,200 e-commerce sites in the United States, Canada, Australia and Japan.

Start with the numbers. More than 100 sites fell. A successful intrusion took about 23 hours. Fagerland estimated the campaign cost at about $5,000 in model tokens, or roughly $50 per breach. One person, a few thousand dollars, and a workforce that does not sleep.

The unit of cybercrime is no longer the hacker. It is the panel.

The board

Cairn is not a bespoke hacking tool. It is a general-purpose problem-solving engine: give it an origin and a goal, and agents search for a path. They write what they find to a shared board of facts, intents and hints. Each worker reads the graph, acts, and posts the result. They coordinate by leaving notes, not talking. An agent can die; the notes remain. It is a queue with memory.

The README says the team was the only one to solve all 54 problems at a Tencent Cloud penetration-testing challenge.

The door

In one intrusion, the agents found no weakness in a large company's public application. They went looking for the infrastructure behind it, found a public control panel, and found a subtle flaw in how it processed data. After hours of trial and error, they talked the server into running their commands. “It's not straightforward to come up with solutions like that,” Fagerland said. “It's not script kiddie stuff.”

The panels were not breached. They were found. Fagerland scanned for Cairn servers reachable from the open internet; about two dozen were, and he judged more than 20 malicious. NorForge's Trufflehog scan verified 11 per cent of the exposed secrets as valid.

What the code says

I downloaded and read the shipped code. The command-line server defaults to 127.0.0.1. The Docker recipe in the README runs cairn serve --host 0.0.0.0 and publishes port 8000. The app mounts five routers and asks for no authentication. There is no login screen to misconfigure. The panel is the perimeter. The easiest way to run it puts that perimeter on every interface.

The exposure is a deployment choice, not a hidden one. A careful operator can bind it to localhost or put it behind a proxy. The recipe is the problem: it makes the open version the default path. That is how a tool becomes a window.

What it costs

Deere said it took “necessary remediation actions” and had “no indication that sensitive information was accessed”. SharkNinja said the attack hit a standalone product-support site and was contained. Cummins said it was investigating a third-party vendor's site. Reuters could not establish how much data, if any, was taken.

The campaign rented a workforce by the token, and did not sleep, did not get bored, and did not need a share. At that price, the constraint is no longer skill. It is target selection.

What the window does not show

This is one firm's view through a window the attackers left open. The 100 is a floor, the $5,000 is his estimate, and “Chinese-speaking” describes a keyboard, not a passport. Cairn's author, le1xia0, says the platform was not designed for attacks. That is true. It is also not a defence: a general engine does not choose the goal.

The operation was visible because it was careless. The next campaign will close its panel. The agents will still be cheap; the watching will get harder. The lesson is not that AI can hack. It is that the panel running the agents is now the softest door in the building.

The attack was automated. The watching was not. If you run agents and want the panel shut, email brandon@kreostudio.co.uk.