Open-Source Cairn Agent Engine Exploited in Autonomous Breaches Across More Than 100 Sites
Security researchers found more than 20 exposed instances of Cairn, an open-source platform that calls itself a "general-purpose problem-solving engine," that are likely malicious. One of them was used by a hacker to break into more than 100 websites with an army of AI agents that mostly operated on their own. The attacker laid out "preferred intrusion tactics" in fewer than 100 Chinese characters, with successful breaches taking about 23 hours. Teams deploying agentic problem solvers should sandbox network access and avoid leaving orchestration endpoints exposed.
Why it matters
Security researchers found more than 20 exposed instances of Cairn, an open-source platform that calls itself a "general-purpose problem-solving engine," that are likely malicious. One of them was used by a hacker to break into more than 100 websites with an army of AI agents that mostly operated on their own. The attacker laid out "preferred intrusion tactics" in fewer than 100 Chinese characters, with successful breaches taking about 23 hours. Teams deploying agentic problem solvers should sandbox network access and avoid leaving orchestration endpoints exposed.