# Hijacked Cairn AI Pentesting Agent Panels Used to Install SSH Keys, Poseidon RAT and Steal API Keys (AIA0009 / AIA0010)

> NorForge research, as reported by Cybersecurity News on 2026-10-27, found at least 17 exposed Cairn AI agent orchestration panels (including red-team and CTF deployments) compromised through malicious task injection starting 2026-10-20. Two activity clusters, AIA0009 and AIA0010, had Cairn's own agents install unauthorized SSH keys, deploy the Go-based Poseidon RAT (Mythic framework agent) and harvest API keys, tokens and secrets from environment variables and config files.

- **Published:** 2026-10-27T11:12:43Z
- **Last reviewed:** 2026-10-27T11:12:43Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-4532
- **ID:** TL-2026-4532
- **Severity:** HIGH
- **Category:** MALWARE
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 10 (full data via the Threadlinqs MCP server — Purple tier)

## Description

Cairn is an open-source autonomous AI agent orchestration platform: operators define a goal, agents work toward it step by step, and findings are posted as 'facts' visible through a web panel. Many panels were exposed to the internet without authentication, so third parties could submit tasks that the operator's own agents then executed with the operator's privileges and without validation. The tool's author (le1xia0) has stated Cairn was not designed for attacking. NorForge (researcher Snorre Fagerland) had been scanning for exposed Cairn instances since about 2026-10-02 and published separate research ('Inside Cairn') on attacker-operated panels; this record covers the hijacking of panels that belong to other operators, as reported by Cybersecurity News.

Two clusters are tracked. AIA0009 uses random hexadecimal suffixes in task names and a 'cairnscan' tag, and focuses on persistence and malware delivery. Its first phase was 11 injected tasks, including 'Install kali SSH key', which instructed agents to append an attacker public key to authorized_keys. On 2026-10-21 at about 21:15 UTC a task titled 'Local worker maintenance' carried a base64-encoded script that downloaded a Linux binary, verified its SHA256, and ran it as a background process. The binary is the Go-based Poseidon agent, normally controlled through the open-source Mythic red-team framework. It persisted until an operator-created stop file appeared. Three C2 generations were observed (103.181.134.12, 199.91.220.129, 64.176.50.179), plus a Bunny CDN (b-cdn.net) hostname.

AIA0010 uses task names that mimic Cairn's own intent labels (for example 'i014') and targets internal services, credentials and other exposed panels. No malware deployment was observed for AIA0010, and NorForge treats it as separate pending further correlation. In both clusters, follow-on tasks searched system folders and configuration files for API_KEY and ANTHROPIC_AUTH_TOKEN variables and returned the secrets through public fact text visible on the panels. Exposed data included AI model API keys, SSH key material, environment variables, config-file secrets and internal service details. At least 17 panels were affected, including red-team and CTF platforms.

Caveats: the AIA0009/AIA0010 details come from a single secondary report (Cybersecurity News) of NorForge research. The original NorForge write-up on these two clusters could not be retrieved, and the NorForge 'Inside Cairn' post lists AIA0001-AIA0003 only. No CVE or CVSS applies; this is an exposure and abuse of unauthenticated agent task intake. The same report separately mentions an AstraRCE defacement on 2026-10-20 and unrelated retailer targeting (105 projects, September 2026). Those are not part of the AIA0009/AIA0010 activity.

## MITRE ATT&CK

- T1595.002 Vulnerability Scanning
- T1190 Exploit Public-Facing Application
- T1059 Command and Scripting Interpreter
- T1059.004 Unix Shell
- T1098.004 SSH Authorized Keys
- T1027 Obfuscated Files or Information
- T1140 Deobfuscate/Decode Files or Information
- T1552.001 Credentials In Files
- T1552.004 Private Keys
- T1005 Data from Local System
- T1071.001 Web Protocols
- T1567 Exfiltration Over Web Service
- AML.T0053 AI Agent Tool Invocation

## Sources

- [Hackers Hijack AI Pentesting Agents to Install Backdoors and Steal API Keys](https://cybersecuritynews.com/ai-pentesting-agents/)
- [NorForge blog (Inside Cairn: Open Windows into massive AI-Driven Cyber Operations)](https://norforge.com/blog/inside_cairn)
- [NorForge blog index](https://norforge.com/blog)
- [The Hacker News: Hackers Use Autonomous AI Agents to Breach Company Websites (Cairn / NorForge)](https://thehackernews.com/2026/10/hackers-use-autonomous-ai-agents-to.html)
- [NorForge Finds Exposed Cairn Panels; Reuters Links Campaign to 100+ Company Breaches](https://letsdatascience.com/news/norforge-finds-exposed-cairn-panels-reuters-links-campaign-t-dd7a2a2d)
- [Hackers Use AI Agents to Do Hacking for Them (PYMNTS)](https://www.pymnts.com/?p=4325994)
- [AI pentest Cairn attack activities](https://book.st-hakky.com/en/news/ai-pentest-cairn-attack-activities)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-4532