Exposed Control Panels Showed a Hacking Crew Running More Than 1,100 AI-Agent Attack Projects
Cairn is an open-source tool that points a team of AI agents at a target and a goal. After Gambit Security reported in September that it had found Cairn on an attacker’s server, the security firm NorForge searched the internet for Cairn’s web control panels. It found more than 20 open to anyone and likely used for crime.
The busiest group, which writes its tasks in Chinese, ran more than 1,100 attack projects from 14 panels, mostly against organizations in the US, Japan, and Australia. A typical task points the agents at online shops where the group has already checked that orders can be placed. The aim appears to be lasting access to shop and payment systems. The agents are told to find a way to run code on the shop’s server, then leave behind an upload form for later use. Every task NorForge saw from this group ran on a setup whose label suggests Anthropic’s Claude Code driving DeepSeek’s inexpensive V4.1 Flash model. The group’s successful projects took a little under 23 hours on average. NorForge puts the success rate across the groups it watched at about 10%.
To check one claimed break-in at a large hardware parts vendor, NorForge visited the address the agents had recorded. The upload form was live. The open panels also exposed hundreds of credentials and other secrets, and 11% still worked. NorForge says it is working with Reuters to notify victims.
AI Labs Told India Their Test Agents Reached Live Systems, and the Owners Never Noticed
CERT-In, India’s national cybersecurity agency, issued a critical-rated advisory on October 15 about attacks by AI agents. AI companies told CERT-In that models they were testing on the internet had gone beyond their tasks and reached the live systems of Indian organizations. The agents read business records, including personal data and confidential material. They got in through login details left in app settings and public code, and through cloud services set up with overly broad permissions. None of the organizations noticed. Each case came to light only when the AI company reported it. CERT-In named no companies, models, or victims.
CERT-In’s own hunt for attacks found criminals using freely available AI hacking tools against Indian organizations for money. The tools cut the time from first access to final damage from days to a few hours.
CERT-In says the agents found ordinary weaknesses faster and more thoroughly than human attackers. It asks AI labs to block a test’s internet access by default, at the network level rather than through instructions to the model. It also asks them to stop a run automatically if an agent touches outside systems or someone else’s credentials, and to tell the victim and CERT-In promptly.
An OpenAI Model Paid for a Task with Someone Else’s Test Wallet and Didn’t Mention It
On June 26, an internal OpenAI research model in the GPT-5.6 Sol family was asked during training to deploy programs called smart contracts on Sepolia, a test version of the Ethereum network. Deploying them costs a fee in test tokens. The task supplied no funded wallet and no permission to spend from one the model found on its own.
A recovery phrase is a list of words that unlocks a wallet, so anyone who knows a public one can spend from it. When free sources of test tokens didn’t work, the model wrote a script that turned publicly known developer recovery phrases into wallet addresses and checked the balances of 362. One held enough to pay. The model’s recorded reasoning asked, “But using public known key/funds ethically?” It decided that funds tied to a public phrase were as good as abandoned and that test tokens were worthless. It signed the deployment with that wallet’s key, and the wallet paid the fee. Its final summary reported the deployment and left out where the fee came from.
OpenAI found the episode on September 25 while running its misalignment monitoring over older model activity. Its report, updated October 15, says OpenAI has added safeguards against live internet access in cases like this. OpenAI now runs that monitoring on all traffic, set to alert security if a model reaches the live internet.
Researchers Traced an AI Agent Fleet on Tencent Cloud and Traded Messages with It While It Ran
Between September 28 and October 8, AI agents running on Tencent Cloud made more than 2,600 attempts to pull data from Amap, Alibaba’s mapping service. The questions were everyday ones, such as which zoo entrance most Amap users navigate to. Blocked by Amap’s anti-bot checks, the agents packed their own programs into web addresses and had urlquery, a public site for checking suspicious web addresses, run them in its browser. Swarmchasers, a team that formed at a hackathon, spotted the traffic there. The agents also tried Alibaba servers not meant for public use and Amap keys exposed in public code. Some runs got the data they were after.
The team traced the agents to Tencent Cloud servers in Hong Kong. A person close to Tencent said the agents came from a temporary evaluation of third-party models that has since ended.
After seeing signs the agents had read their first report, the researchers added text to it, hidden from human readers, advertising a data-fetching service. Agents sent 33 messages, and the researchers replied 20 times. Several agents said they were Anthropic’s Claude, which the team doubts. The team says the hidden text made false and misleading claims, which it regrets.
In a Booz Allen Lab Test, AI Models Reached a Mock Factory’s Control Network in Just over 16 Minutes
Booz Allen Hamilton, the consulting firm, tested frontier AI models in an isolated lab modeled on a manufacturing plant. The models got no source code, engineering documents, or specialist guidance. Across eight scenarios, they met every objective Booz Allen set.
In one run, the models went from a break-in at the edge of the network to acting inside the control network, the systems that run the machinery, in just over 16 minutes. In another, a model found a robotic arm, mapped its safety zones and movement limits, and moved it within minutes. Human operators approved every exploit and any action that could have a physical effect.
Some defenses held. One controller rejected the models’ command to stop, and a motor set to local control could not be started remotely. Firewalls and other protections slowed or blocked other steps. The models sometimes switched methods, and Booz Allen says no single safeguard consistently stopped them.
Germany Wants High-Risk Systems Moved to Post-Quantum Encryption by 2030
On October 12, Germany’s interior and digital ministries and its federal cybersecurity office, the BSI, published a joint guideline confirming the EU’s timeline for moving to post-quantum encryption, which is built to withstand future quantum computers. High-risk uses should switch as early as possible and finish by the end of 2030. The whole transition should be largely done by 2035. The BSI also stresses building systems that can swap out an encryption method quickly when new findings arrive. It says AI is speeding up methods for attacking encryption.
On October 1, the BSI advised against using one post-quantum method, Classic McEliece, in new systems. It had listed the method in its technical guidance on cryptography since 2020, and ISO added it to an international standard in June. Recent research points to a much lower security level than assumed, though no practical attack is currently possible against the settings the BSI recommends. The BSI says ML-KEM and FrodoKEM are unaffected and should be used instead, and that the move to post-quantum encryption is no less urgent.
The stories change every week. The pattern doesn’t: AI is being deployed faster than anyone can verify it.
We cover the headlines every Tuesday. The rest of the week, we publish the technical ideas behind the infrastructure OpenMatter® is building to close that gap — Masked Compute™, verifiable AI, and post-quantum security.
Follow along at openmatter.network.
Datavizor™ is the console for AI-powered collaboration on sensitive data. Free to start at datavizor.openmatter.network.