AI Agent Cyberattacks: What Cairn Evidence Shows

AI agent cyberattacks were coordinated through Cairn against more than 100 websites, according to Norforge researchers—but that finding does not establish how independently the agents selected targets or carried out each attack. It does show that a general-purpose agent platform can be put to work as operational infrastructure for intrusion attempts.

What Norforge found in Cairn-enabled attacks

Cairn is an open-source AI platform that lets users set start and end points for agents and have them document their progress. Norforge researchers found hackers using it to coordinate attacks on more than 100 websites, with agents operating largely on their own. The researchers also identified more than 20 exposed Cairn instances they consider likely malicious and said they are working to have them taken down.

One detail makes the setup worth examining: the most active attacker used fewer than 100 Chinese characters to describe preferred intrusion tactics. That is a compact instruction, but it is still an instruction. Cairn appears to have provided a way to organize agent activity around a human-set task; the available account does not show that the agents independently decided to attack websites or devised the underlying intent.

The finding is meaningful without making a stronger claim than the evidence supports. It documents use of AI agents in attacks, not a new kind of autonomous judgment.

A short prompt is not proof of independent agency

The distinction matters because “largely on their own” can sound like a system acting without human direction. Yet Cairn’s design includes user-defined endpoints, and Norforge’s account says the attacker supplied tactics. Those facts point to a division of labor: a person specified a goal or method, while agents handled parts of the work. The source does not provide enough detail to measure how much each agent did, how often human intervention occurred, or whether the attacks succeeded in compromising the sites.

That is the gap between the headline-sized claim and what is shown. The number of targeted websites indicates scale, but it does not answer questions about impact, agent autonomy, or repeatability. Norforge’s finding that more than 20 exposed instances are likely malicious is a warning about deployments, not a count of confirmed successful breaches.

Cairn’s creator describes it as a general-purpose problem-solving engine, says it was never a “hacking tool,” and frames misuse as a human decision rather than a feature of the engine. That distinction is relevant, but it does not settle the practical question: a tool need not be designed for hacking to help coordinate it. In my view, responsibility cannot be assigned just by asking what the platform was intended to do; the capabilities it makes available and the safeguards around exposed instances matter too.

The defensible claim is about coordination, not autonomy

The evidence supports a narrower conclusion: people used Cairn to coordinate AI-agent activity in attacks on more than 100 websites, and Norforge found more than 20 exposed instances it considers likely malicious. It does not establish that agents chose targets on their own, nor does it quantify the damage.

That framing avoids both easy exits: treating the event as proof of rogue agents, or dismissing it because Cairn is general-purpose. The unresolved issue is how much work these systems can take over once a human supplies direction—and what controls exist on exposed deployments. For now, the strongest claim is that AI agents can serve as components in human-directed cyberattacks, not that the attacks were independently conceived by AI.