NorForge found over 20 open panels where hackers steer AI agents at online shops

Most of the panels belong to one Chinese-language group that sends cheap DeepSeek-powered agents after shopping sites, and anyone can watch.

By Think Facility · October 19, 2026 · AI agents AI safety

On October 19, 2026, the security firm NorForge published what it found inside more than 20 control panels that hackers had left open on the internet. Each one runs Cairn, a tool that takes a target and a goal and sets AI agents loose to break in.

The panels show the work in full: which sites were picked, what the agents found and whether they got in. NorForge says every operator it could profile appeared to be after money, and it saw no obvious state-sponsored activity.

Exposed panels: More than 20 Cairn panels
Largest cluster: 14 panels, over 1100 attack projects
Model named: DeepSeek 4.1 Flash
Estimated cost: around $5 a task
Success rate: around 10%
Start to goal: a little under 23 hours

What the panels show

NorForge went looking after Gambit Security reported in September 2026 on a campaign against online marketplaces that used Cairn alongside other AI tools. Searches of internet scanning engines turned up a handful of open Cairn panels, and new ones kept coming online.

Cairn treats each job as a project with a starting point and an end goal. Agents post what they find to a shared board, pick a next step and keep going, and a human can drop hints onto the same board. It isn't built only for hacking. NorForge calls it a general problem-solving engine. These operators just happen to point it at other people's websites.

The busiest group, which NorForge calls AIA0001, writes its instructions in Chinese and ran over 1,100 attack projects across 14 panels. Its targets are mostly in the US, Japan and Australia, and NorForge thinks the aim is lasting access to e-commerce and payment systems, to cash in on later.

Its targets arrive pre-sorted, ranked by traffic and checked with a browser robot to make sure orders go through. A small bug gave the group away. Some script of theirs strips one "w" too many from web addresses, so "wholesale" turns up as "holesale" on panel after panel (which made the related panels easy to spot, NorForge says).

These are confirmed real shopping/e-commerce websites in four countries (US/CA/JP/AU), with traffic of 200,000–1.5 million.

From Inside Cairn: Open Windows into massive AI-Driven Cyber Operations

Which AI does the work

Every AIA0001 task NorForge saw ran on a worker named claudecode_deepseek-v4.1-flash. NorForge reads that as possibly a Claude Code harness driving DeepSeek's 4.1 Flash model, released in September. One agent's notes mention a leftover setup from a Tencent hacking competition, and NorForge says there's no reason to believe Tencent had anything to do with it.

And it's cheap. NorForge doesn't have token counts, so it guessed from the data: around $5 for an average task, failed attempts included, and more than $100 for the longest projects. It says those numbers could be off by a clear margin. Still, its own word for the cost is cheap.

A second group, AIA0002, writes in English and goes after credit cards and cryptocurrency. Some of its projects start with nothing more than "fetch credit cards" and leave the rest to the agents. A third panel, with 59 projects, is one NorForge rates as malicious only with low confidence.

Did they get in?

About one task in ten reached its goal, NorForge estimates, and many more got partway. For AIA0001's successes, the average run from start to goal took a little under 23 hours. One project ran for more than five days. (NorForge calls all of this a snapshot, since models and harnesses change very quickly.)

NorForge checked one claim itself. A finished task against a large hardware parts vendor named the address of a webshell, and when the researchers fetched it, the uploader was live. The write-up adds six case studies, from an Australian shop to a very large US retailer.

These are autonomous offensive agents with considerable capabilities, potentially available to anyone who stumbles across their control panels.

Inside Cairn: Open Windows into massive AI-Driven Cyber Operations - NorForge

The open panels are a hazard of their own, and a bit of an own goal for the people running them. NorForge ran the secrets scanner Trufflehog over their contents and found hundreds of passwords and keys, 11% of them verified valid. The panels also expose the controls for starting, stopping and redirecting agents, though NorForge says it didn't test whether those work for a stranger.

What it means if you shop online

Online shops are a big target. The Census Bureau puts US retail e-commerce at $340.2 billion in the second quarter of 2026 (adjusted for seasonal variation), or 17.1 percent of all retail sales. AIA0001's task lists are built from exactly those sites.

For a shopper, the risk is the card number typed at checkout. The FTC says that for a credit card, the maximum you might be responsible for after unauthorized use is $50. Debit cards are less forgiving: report within 2 business days and your loss stops at $50, but more than 60 calendar days after your statement it can be all the money taken from the account.

The report doesn't say how many cards, if any, AIA0001 took. Its tasks ask for access to use later. What I take from it is the arithmetic for anyone running a small web shop: an attacker can now try a site for around $5 and have an answer in about a day.

Legitimate testers are exposed too. NorForge found apparently genuine red team jobs on open panels as well, which publishes a client's weak spots to anyone who finds the page (it isn't naming those firms).

What's next

NorForge says it's working with Reuters to notify victims, especially those that appear to have been compromised, and it's trying to get the panels taken down. It won't publish their addresses until then. I suspect some are already gone: many of AIA0002's panels went dark during the investigation. Whether the takedowns work depends, it says, on how the hosting companies respond.