NorForge

Record description

NorForge is an AI-agent containment and security-research company. Its October 2026 Cairn investigation examined externally reachable agent-operation dashboards and separated suspected criminal operations from legitimate security testing. Panel observations, reported victim counts and model usage must not be treated as uniformly authenticated intrusions.

Its Cairn investigation is evidence about exposed panels, command traces and apparent actor groupings. It cannot by itself prove that every dashboard project became an intrusion, or attribute unrelated legitimate panels to a criminal actor simply because their orchestration software is similar.

NorForge’s subsequent October 26 investigation examined a different direction of attack against Cairn: outsiders used exposed control panels to submit tasks to autonomous pentesting agents. The researchers counted seventeen accessible panels and reported some payload execution, but not a verified complete takeover of every agent or a common criminal owner. This is distinct from viewing logs or project lists on previously exposed panels. Later investigation.

The exposed-panel survey and subsequent panel-subversion exercise require separate sampling frames. The former groups apparent Cairn operator infrastructure and projects (including AIA0001 and AIA0002), with incomplete proof connecting each named target to a real intrusion. The latter tested whether outside users could submit new instructions to seventeen accessible agent panels and observed selected payload effects. Neither count provides a population of fully compromised victims, and neither by itself identifies the operator behind the panels. A meaningful cross-case identity match would require common host identifiers, preserved job commands, network destinations and victim-side forensic traces; an identical framework or agent capability alone is not enough. Panel survey and task subversion.

Explicitly related research (2)

Declared connections