Who this is for

  • Finance brokers
  • Legal firms
  • Accounting firms
  • Consultants
  • Trades
  • Clinics

The stories

An AI hacking tool was left open online, and showed what it was attacking

Posted 19 October 2026

NorForge, a security firm, published a report on 19 October about Cairn, a free tool that coordinates AI agents (software that carries out a task step by step on its own) to probe a website, find a weakness and break in.

NorForge found more than 20 Cairn control panels left open on the internet, apparently run by criminals, mostly for money. The panels recorded what each attack found.

The largest group, run by Chinese-speaking operators, logged more than 1,100 attack projects. The targets were mainly in the US, Japan and Australia, apparently to get lasting access to online shops and payment systems.

NorForge estimates about 10% of attempts succeed, and a successful one took a little under 23 hours on average. It puts an average attempt at about $5, with a warning that the figure could be well out.

The weaknesses it lists are mostly old: flaws in login pages, upload forms that let a file be planted, unpatched older software, pages that needed no login at all, and errors that give away too much.

NorForge names no victims. It says it is working with Reuters to notify them and is seeking takedown of the panels. It gives no specific advice for small businesses, so the actions below are ours.

Clear takeaways

  • AI has cut the cost of trying to break into a website to a few dollars an attempt.
  • The weaknesses attackers used are mostly old and fixable: out-of-date software, weak logins and upload forms.
  • Nobody has yet published advice aimed at small firms, so the question to ask is your own: who keeps our website software up to date?

Do this now

  1. Ask whoever built or hosts your website which version of its software and plugins it runs, and when each was last updated.
  2. Ask them to remove any login pages, upload forms or test pages you do not use.
  3. Ask who gets the alert if the site is changed without anyone asking. If the answer is nobody, fix that first.
  4. Check that your booking, client portal or payment forms are on a supported system and not an old copy.

Sources