AI agents are now cheap enough and capable enough to point at a target and let run — and a lot of the dashboards that control them were never locked. An investigation published by NorForge on October 19, 2026 found more than 20 exposed Cairn panels on the open web, each one a window into how threat actors pick targets, steer autonomous agents, hunt for weaknesses, and keep a foothold once they're inside.
The headline that's been passed around puts it even more bluntly: hacking a corporation is now within reach of just about anyone with a modest budget and a free weekend. Whether that price tag holds everywhere or not, the point lands. This isn't a nation-state-only capability anymore.
What happened
A marketplace hack led to a much bigger find
The trail started in September 2026, when Gambit Security reported on a criminal campaign targeting online marketplaces. Investigators recovered an attacker's staging server — the machine a crew uses to prepare and launch attacks — and found AI harnesses sitting on it: Hermes, Strix, and Cairn.
A harness, in plain words, is the rig that lets a person drive an AI model. You give it a job, you watch it work, you step in when it goes sideways. Think of it as the steering wheel and dashboard bolted onto the engine.
Why so many of these dashboards are wide open
Like most modern software, these harnesses ship with a web dashboard you log into from a browser. Sometimes the login is enforced. Sometimes the operator just… doesn't. NorForge used Shodan and Censys — search engines that index internet-connected servers and devices instead of web pages — and found hosts running all kinds of AI harnesses. Most asked for authorization. Quite a few didn't. Cairn turned out to be one of the most neglected.
The first searches turned up a handful of open panels. New ones came online within days, and the target lists, the language in the notes and the instructions showed many of them belonged to the same crews.
What an open panel actually shows
More than you'd think. Each panel displays who's been targeted, which weaknesses were found, account secrets and API keys, and whether a system has actually been compromised. That's why NorForge redacted the data aggressively and is holding back the panel addresses until they can be taken down — which is also why you won't find a handy list of them in this article.
Cairn is more boring than the myth
Cairn often gets called an "autonomous penetration testing engine." NorForge argues that's only half right. It's really a state-based problem-solving engine: you give it an origin (where it starts) and a goal (what success looks like), and it grows toward that goal step by step.
The closest everyday analogy is a GPS that keeps recalculating. Between origin and goal it cycles through facts and intents. A fact is something the agent discovered. An intent is what it decided to do next. Every fact gets posted to a shared blackboard — the digital version of a whiteboard in a war room — and a human operator can scribble hints on the same board. The panel draws the whole thing as a graph, cyan at the origin, red at the goal. Not every branch wins. One of the visible attacks was aimed at a major US online retailer.
And it wasn't only criminals
A considerable number of apparently legitimate red team operations — the good guys who break in with permission — were exposed the same way. Which means paying clients' secrets were sitting on the public internet too.
What it means for you
You probably aren't being hand-picked by anyone. But you are whatever the agent bumps into first, and AI agents don't get bored, don't skip the tedious test, and don't clock off at 4:45 on a Friday.
At home
Your router's admin page, your smart camera, the password you've been recycling across a dozen sites since forever, and any marketplace account where you've saved a card. The Gambit campaign went after marketplaces specifically. If one email-and-password combo leaked in an old breach and you still use it on a shopping site, you're the easy branch on somebody's graph.
At work
The scariest panel usually isn't on your laptop — it's the analytics dashboard your vendor left open by accident. You can do everything right at your desk and still get caught in someone else's mess. Worth remembering the next time a security memo lands in your inbox.
Running a business
Staging servers, admin panels for your analytics, the back end of a booking tool — these get spun up for a test and forgotten. Now ask the question out loud: where does that dashboard actually live, and who can reach it? If you don't have a security person on staff, free AI tools like the ones at MyKreaTool will happily draft a plain-English checklist you can hand to your developer.
Studying
Shared laptops, group chats where someone screenshots an API key, and free AI tool accounts registered with a student email. Campus networks are big, noisy and full of reused passwords — a great place for an automated agent to wander around unnoticed.
For creators
Your portfolio site, your email marketing tool, your payment dashboard. Small creators get hit precisely because nobody's watching the shop at 2 a.m. A hijacked mailing list is worth real money to someone.
Earning income
Freelancers juggle client logins, ad accounts and API keys across a dozen tabs. Ad accounts are especially juicy — someone who can spend your budget or run their own ads on your card. If a key ever sat in a public repo or a shared doc, assume it's burned and rotate it.
How to try it right now
You can't browse the criminal panels — and you shouldn't want to. What you can do is look up your own footprint with the same free tools the researchers used. Here's the short version.
1. Start free with the search engines. Open Shodan and Censys Search in your browser. Both let you search by domain or IP address, and you can create an account in a couple of minutes. Nothing to install.
2. Search your own domain. Type in your website, your IP range, or your business name. You're looking for hosts you recognize.
3. Hunt for the giveaway words. Scan the results for anything labelled admin, login, dashboard, panel, staging, dev or test. If you don't recognize it, that's your first phone call.
4. Do the boring account audit. Any password shared between an admin dashboard and anything else gets changed today. Turn on two-factor authentication everywhere it's offered.
5. Rotate keys. Any API key that has ever been pasted into a doc, a chat or a repo gets replaced and the old one revoked.
6. Ask your vendors. If you hire a pentest or red team firm, ask where their control panel lives and whether it's reachable from the public internet. "We'll check" is an acceptable answer; silence isn't.
7. Put it on repeat. Set a calendar reminder every quarter. Exposure creeps back in the moment someone spins up a test server.
Upsides and what changes
The uncomfortable upside is that the same technology cuts both ways. If an AI agent can hunt for weaknesses, an AI agent can also be pointed at your own systems to find them first — and it doesn't need a consultant's day rate to do it. Small businesses that could never justify a formal security assessment now have a fighting chance of spotting their own open panels before someone else does.
Expect a few other shifts. Vendors will start getting asked, in writing, whether their dashboards are reachable from the open internet. "We use AI for security" will stop sounding impressive and start sounding like a question about configuration. And boring hygiene — unique passwords, two-factor, key rotation — quietly becomes the highest-return thing you do all month.
Exposure also becomes measurable. You don't have to guess whether your staging server is visible. You can look.
Limitations
Be honest about what this investigation can and can't tell you. It's a snapshot from one research team, the panels were heavily redacted, and the addresses are being withheld until they're taken down — so you can't independently verify any individual finding. Shodan and Censys only see what's exposed on the public internet; they won't show you a phishing email, a stolen password, an insider, or a compromised supplier. An open panel also doesn't automatically mean an attack happened — plenty of legitimate red teams leave theirs open by accident, which is careless but not criminal. And checking your own footprint won't fix anything that's already breached. It tells you where the door is; you still have to close it.
Conclusion
The takeaway isn't that AI is terrifying. It's that the control panels for powerful AI agents are ordinary web apps, and ordinary web apps get left unlocked all the time — by criminals and by the good guys alike. The gap between a cheap automated attack and a properly configured login is embarrassingly small, and it's mostly maintained by routine, not genius.
One action for today: open Shodan, search your own domain, and look for anything with "admin," "login" or "staging" in the result. If you find a dashboard you don't recognize, change that password and tell whoever runs it — today, not next sprint.
Comments 0