Hackers Compromise AI Pentesting Agents to Install Backdoors and Steal API Keys

Attackers have begun targeting the AI tools security teams use to test their own networks. A new investigation describes automated campaigns that breached exposed web panels for Cairn, a platform that runs autonomous AI agents against user-defined goals.

After gaining access to those panels, the intruders injected tasks for the agents that installed unauthorized SSH keys, downloaded a remote access trojan, and searched for stored API keys. The observed activity began on October 20, 2026, although some signs indicate earlier reconnaissance.

Cairn is designed to make agentic workflows simple: a user sets a goal and a starting point, and the agent executes actions and posts its findings as facts to a web panel. Anyone who can reach that panel can view projects, create new tasks, and stop or delete running agents — which means an unprotected panel gives an attacker powerful control.

On October 20, accounts using the handle AstraRCE defaced a number of Cairn panels; that vandalism was observed separately from the later, more targeted intrusions.

Sandboxing firm NorForge, which researches AI agent security, discovered the malicious activity while passively monitoring exposed panels. In a technical blog post, NorForge described the injected tasks, cataloged the malware and its command-and-control infrastructure, and said it did not interact with the attackers.

Hackers Hijack AI Pentesting Agents

The intrusions began as a cluster of 11 new tasks created on a single panel. The tasks were atypical: their titles contained strange hexadecimal strings and the tasks only targeted the local Cairn host rather than external systems.

One injected task was labeled “Install kali SSH key” and instructed the agent to append an unfamiliar public key to the kali user’s authorized_keys file. The agent executed the instruction without validation. Shortly afterward, those tasks disappeared from the panel.

NorForge later found similar injected tasks on at least 17 exposed panels; some of those panels belonged to red teams and capture-the-flag exercises.

The campaign escalated to malware the next day. On October 21 at 21:15 UTC, a task named “Local worker maintenance” appeared on a panel carrying a base64-encoded script. The agent decoded and executed the script, which downloaded a Linux binary, verified its SHA256 hash, and launched it in the background. NorForge identified the binary as a Poseidon implant — a Go-based remote access trojan commonly managed via the open source Mythic red team framework.

The malware continued running until an operator created a stop file, suggesting the attackers intended it to remain active as long as possible. This pattern mirrors other incidents in which exposed AI gateways are abused to steal credentials.

The reconnaissance tasks also searched the file system and environment variables for strings like API_KEY and ANTHROPIC_AUTH_TOKEN. Some tasks wrote discovered secrets into public fact texts on the panel, making them visible to anyone who could view the interface. NorForge reported that the campaign exfiltrated secrets, including AI model API keys.

Notably, these risks do not always require custom malware: agents that execute commands and read configuration files can leak credentials during normal operation, highlighting the broader unseen credential-surface risks posed by agentic systems.

Two Clusters and the Broader Risk of Agentic AI

NorForge has grouped observed activity into two clusters it calls AIA0009 and AIA0010. AIA0009 appends random hexadecimal suffixes to task names and uses a “cairnscan” tag for probing; it focuses on persistence, access, and malware delivery. AIA0010 uses task names that mimic Cairn’s own intent labels (for example, “i014”) and appears to hunt for internal services, credentials, and other exposed panels.

NorForge found no shared definitive indicators tying the two clusters together and currently treats them as separate actors, although that assessment could change with additional data. To date, only AIA0009 has been observed deploying malware.

NorForge asked whether AI played a role in running the campaign. The activity arrived in synchronized waves across multiple panels, consistent with scripted automation. Human operators also appear to have intervened at key moments, such as pausing before the malware deployment while the attackers configured the command and download servers.

Regardless of the exact mix of automation and human action, NorForge says the larger problem is what agentic systems expose. Earlier research, including the AgentCorruption attack chain, demonstrated how a single prompt could reach API keys, OAuth tokens, and secrets stored in services like AWS Secrets Manager.

Cairn has been abused in other ways as well. Gambit Security reported that a financially motivated operator used Cairn to run 105 projects against retailers in a single week in September.

Organizations running Cairn should secure their panels immediately. NorForge recommends executing agent tasks inside containers, enforcing strict boundaries for agents, and never leaving panels exposed to the public internet. Teams should also rotate any API keys that might have been leaked and inspect SSH authorized_keys files for unknown entries.

Indicators of Compromise (IoCs)

Note: IP addresses and domains are intentionally defanged (for example, using “[.]”) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat-intelligence platforms such as MISP, VirusTotal, or your SIEM.

Give your SOC the alert context to stop incidents quickly. Integrate threat intelligence from thousands of SOCs.