Hackers Hijack AI Pentesting Agents to Install Backdoors and Steal API Keys

Hackers are now targeting the AI tools that security teams use to test their own networks. A new investigation describes automated campaigns that break into exposed panels for Cairn, a platform that gives AI agents goals and lets them work on their own.

Once inside, the attackers push new tasks into those agents. These tasks install unauthorized SSH keys, download a remote access trojan, and search for stored API keys. The activity started on October 20, 2026, although some signs point to earlier probing.

Cairn is built to make AI agents easy to run. A user defines a goal and a starting point, and the agent carries out the work while posting its findings as facts on a web panel.

Anyone who can reach that panel can view projects, start new tasks, and stop or delete running ones. That control makes an unprotected panel very valuable to an attacker.

On October 20, someone using the handle AstraRCE defaced many Cairn panels, but that vandalism was separate from the later intrusions.

Researchers at NorForge, a sandboxing firm that works on AI agent security, identified the malicious activity while observing exposed panels.

In its technical blog post, the team described how the injected tasks worked and documented the malware and its command-and-control servers. The company said it only observed the panels passively and did not interact with the attackers.

Hackers Hijack AI Pentesting Agents

The intrusions first appeared as a series of 11 new tasks on one panel. These tasks looked different from normal work, with strange hexadecimal strings in their titles.

They only pointed at the local Cairn host, not at outside targets. One task was named “Install kali SSH key.” Its instructions told the agent to add an unknown public key to the authorized_keys file of the kali user. The agent followed the instruction without question.

Shortly after, the malicious tasks vanished from the panel. NorForge later found similar injected tasks on at least 17 exposed panels, and some of those panels belonged to red teams and capture-the-flag exercises.

The campaign then moved to malware. On October 21 at 21:15 UTC, a task called “Local worker maintenance” appeared on one panel. It carried a base64-encoded script that the agent decoded and ran.

The script downloaded a Linux binary, checked its SHA256 hash, and launched it in the background. NorForge identified the binary as a Poseidon implant, a Go-based remote access trojan that is typically managed through the open source Mythic red team framework.

The malware kept running until an operator created a stop file, which suggests the operators wanted it to stay active for as long as possible. The same pattern of abusing exposed AI tools has appeared in other reports on exposed AI gateway attacks that steal credentials.

The recon tasks went further than access. One task told the agent to search system folders for files and environment variables containing terms such as API_KEY and ANTHROPIC_AUTH_TOKEN.

Other tasks wrote secrets into public fact texts, where anyone viewing the panel could read them. NorForge reported that the campaign stole secrets, including AI model API keys.

This risk does not always require malware. Agents that run commands and read config files can leak credentials during normal work, as explained in coverage of the unseen credential surface risks that AI agents create.

Two Groups and the Bigger Risk for Agentic AI

NorForge tracks two separate clusters, which it calls AIA0009 and AIA0010. AIA0009 uses random hexadecimal suffixes in task names and a tag called “cairnscan” for its probes.

It focuses on persistence, access, and malware delivery. AIA0010 uses task names that copy Cairn’s own intent labels, such as “i014.” It looks for internal services, credentials, and other exposed panels.

NorForge found no shared hard indicators between the two, so it currently treats them as separate groups, although that view could change with new data. Only AIA0009 has been seen deploying malware.

Researchers also asked whether AI helped run these campaigns. The activity arrived in synchronized waves across several panels, which points to scripting.

Humans also seem to have stepped in at key points, such as during a pause before the malware was deployed, when the command server and download server were set up.

Even so, NorForge believes the bigger issue is what agentic systems expose. A similar risk appeared in the AgentCorruption attack chain, which showed that one prompt could reach API keys, OAuth tokens, and secrets held in AWS Secrets Manager.

Cairn has also been misused beyond this campaign. A separate Gambit Security investigation found that a financially motivated operator used Cairn used against retailers to launch 105 projects in a single week in September.

Anyone running Cairn should secure their panels right away. NorForge advises running agent tasks inside containers, keeping agents within strict boundaries, and never leaving panels open to the internet.

Teams should also rotate any API keys that may have been exposed and review their SSH authorized_keys files for unknown entries.

Indicators of compromise (IoCs):-

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Give your SOC the alert context to stops incidents quickly. Integrate Threat Intel from 16K SOCs.

The post Hackers Hijack AI Pentesting Agents to Install Backdoors and Steal API Keys appeared first on Cyber Security News.