{"type":"post","id":"the-hijacked-cairn-how-exposed-ai-pentesting-panels-6d112b","slug":"the-hijacked-cairn-how-exposed-ai-pentesting-panels-6d112b","title":"The Hijacked Cairn: How Exposed AI Pentesting Panels Become Attacker Infrastructure","description":"RST Cloud says it identified 1,341 internet-exposed consoles for the AI penetration-testing harnesses Cairn, ARTEX and PentAGI as of November 2, 2026.","retrieval_nugget":"RST Cloud says it identified 1,341 internet-exposed consoles for the AI penetration-testing harnesses Cairn, ARTEX and PentAGI as of November 2, 2026. It also describes attackers taking over exposed Cairn panels to steal API and SSH keys and deploy malware. For teams using these dual-use tools, exposure itself creates a risk to operator credentials and infrastructure.","published_at":"2026-11-07","updated_at":"2026-11-07","record_date":"2026-11-07","date_kind":"published_at","topics":["agent-security","agent-harness","security"],"entities":["RST Cloud","Cairn","ARTEX","PentAGI","NorForge","Poseidon"],"related_patterns":["agent-security-moves-to-runtime-boundaries"],"novelty_label":"new_fact","what_changed":"RST Cloud reports more than 1,300 exposed Cairn, ARTEX and PentAGI consoles and says hijacked panels were used to steal credentials and deploy malware.","prior_refs":["https://newruntime.com/posts/censys-finds-1-465-publicly-exposed-artex-ai-38ea2e/"],"source_url":"https://rstcloud.com/hunting-ai-harnesses-cairn-artex-pentagi","source_urls":["https://rstcloud.com/hunting-ai-harnesses-cairn-artex-pentagi"],"schema_version":"newruntime-agent-readable-v0.2","stable_id":"post:the-hijacked-cairn-how-exposed-ai-pentesting-panels-6d112b","status":"published","visuals":[],"editor":{"role":"editor","name":"Andrey Reshetnikov","profile":"https://newruntime.com/owner-profile.md","profile_json":"https://newruntime.com/owner-profile.json","same_as":["https://www.linkedin.com/in/reshetnikov1/","https://t.me/lapetuse"]},"routes":{"html":"https://newruntime.com/posts/the-hijacked-cairn-how-exposed-ai-pentesting-panels-6d112b/","markdown":"https://newruntime.com/posts/the-hijacked-cairn-how-exposed-ai-pentesting-panels-6d112b.md","json":"https://newruntime.com/posts/the-hijacked-cairn-how-exposed-ai-pentesting-panels-6d112b.json"},"markdown_url":"https://newruntime.com/posts/the-hijacked-cairn-how-exposed-ai-pentesting-panels-6d112b.md","next_reads":[{"type":"topic","path":"/topics/agent-security/","url":"https://newruntime.com/topics/agent-security/","title":"Agent Security","reason":"Explore the agent-security topic hub.","media_type":"text/html","markdown_url":"https://newruntime.com/topics/agent-security.md","json_url":"https://newruntime.com/topics/agent-security.json"},{"type":"topic","path":"/topics/agent-harness/","url":"https://newruntime.com/topics/agent-harness/","title":"Agent Harness","reason":"Explore the agent-harness topic hub.","media_type":"text/html","markdown_url":"https://newruntime.com/topics/agent-harness.md","json_url":"https://newruntime.com/topics/agent-harness.json"},{"type":"topic","path":"/topics/security/","url":"https://newruntime.com/topics/security/","title":"Security","reason":"Explore the security topic hub.","media_type":"text/html","markdown_url":"https://newruntime.com/topics/security.md","json_url":"https://newruntime.com/topics/security.json"},{"type":"collection","path":"/posts/","url":"https://newruntime.com/posts/","title":"Field Notes","reason":"Open the latest editorial analysis.","media_type":"text/html","json_url":"https://newruntime.com/posts.json"},{"type":"collection","path":"/sources/","url":"https://newruntime.com/sources/","title":"Sources","reason":"See the original sources this archive cites.","media_type":"text/html"}]}