AI Agents Are Now Attack Labor at About $5 a Task. Two of the Operators' Servers Are on Our Blocklist.
NorForge published a look inside the control panels of three groups using an AI hacking system called Cairn against real companies. The panels were left exposed on the internet. Inside them: more than a thousand attack projects, agents posting what they learned to a shared blackboard, operators nudging them with hints, and worker processes named after the coding-agent harnesses that ran them. NorForge estimates the average task cost about $5 in model fees. This is what the economics of cheap questions look like when the other side uses them, and it is why the decision layer in front of your systems now has to work at machine speed.
What NorForge found
The report, published October 19, describes three clusters of operators running Cairn, which NorForge calls a state-based problem-solving engine: each task is a project with a starting point and a goal, and agents post facts to a shared board as they work.
AIA0001, Chinese-speaking, 14 panels, high confidence: persistent access to e-commerce and payment infrastructure, mainly in the US, Japan and Australia, across more than 1,100 projects.
AIA0002, English-speaking, 10 panels, high confidence: financial theft, meaning card data, crypto and moving funds, against payment processors, gray-market payment services, pharmacy sites and African e-commerce. NorForge sees signs that some of these breaches succeeded.
AIA0003, English-speaking, 1 panel, low confidence: smaller and more exploratory, with projects that start out framed as authorized assessments and get more explicit.
NorForge found no sign of state sponsorship. All three look financially motivated. It is working with Reuters to notify the victims and names none of them.
The workers are coding agents
The detail that matters most for anyone building with AI agents is the worker names. AIA0002's worker is labeled pi_openrouter_deepseek, which NorForge reads as the Pi coding-agent framework calling DeepSeek through OpenRouter. Another worker is labeled claudecode_deepseek-v4.1-flash, which NorForge reads, as an inference, as a Claude Code harness pointed at a DeepSeek model. The agents used Playwright to check target sites before attacking them. The weaknesses in NorForge's case studies are ordinary ones: account changes that need no login, error pages that leak too much, unsafe deserialization, session stores anyone could read.
So the attacker's side of this is cheap questions at scale: point a general-purpose coding agent at a storefront, let it probe for an afternoon, pay a few dollars. Nothing in these case studies needed a new technique. It needed patience, and patience is now metered by the token.
What we did with it, and how long it took
This post is also a test of our own pipeline, so here is the trace, in UTC on October 20.
About 14:30: our headline sweep flagged the report as the one uncovered item in the last day with hard indicators.
We read the primary source. Only two IPs are unredacted, both AIA0002 staging servers on Vultr: 199.247.25[.]25 and 199.247.27[.]2. NorForge is withholding the panel addresses until the panels are taken down, which is the right call.
14:39: the first IP was written to our index and read back by its primary key.
14:40: the second IP's write was accepted by the database and never landed. Our read-back caught it, we retried, and it landed at 14:41. An accepted write is not a stored write. This is the failure that check exists for.
We asked our own instruments whether either IP ever touched us. Zero sightings since April across 982,974 edge blocks, 143,251 canary hits and 8,786 requests that reached our origin. That fits: these groups go after shops and payment sites, not threat-intelligence publishers. Zero in a window that size is a measurement, not a guess.
14:46: both IPs were in our IP blocklist at confidence 80, which is the file our own edge enforces and any subscriber can pull.
Neither IP was in our index before today, from any source. We have no lead on this one. The research is NorForge's.
What to do if you run an online store
The case studies are basic access-control and error-handling bugs. An agent will find the endpoint that changes an account without checking who is asking. Test your own account, password-reset and checkout flows for exactly that, with logged-out requests.
Watch for patient, methodical probing from cloud hosting ranges: many small requests mapping one flow, then a validation pass with a headless browser. It looks like a slow, polite scanner until it doesn't.
If you run your own AI agents or red-team tooling, do not leave the dashboard on the internet. These operators were exposed because their panels were. Yours would expose your targets, your credentials and your client's data the same way.
Block the two staging IPs. When NorForge publishes the panel addresses, we will add them the same day.
The free key that pulls our blocklist, these two included, is at https://analytics.dugganusa.com/stix/register?utm_source=blog&utm_campaign=inside-cairn
If this was useful, or if it wasn't, the rating widget below takes ten seconds and is the only way we know.
Every indicator in this post is in the feed. Free.
1.58M+ IOCs, STIX 2.1 / TAXII, 88% novel vs ThreatFox, exploited-CVE leads ahead of CISA. No credit card — a free API key in 30 seconds, and you can audit every claim above against the live endpoints.
Was this useful? Thirty seconds, no cookies, no tracking, no third parties, your address hashed and never stored. If the box below does not load, the same question lives at https://analytics.dugganusa.com/nps.html?post=ai-agents-are-now-attack-labor-at-about-5-a-task-two-of-the-operators-servers-are-on-our-blocklis
Comments