SZB-40020dc0a3
NorForge reports attacker-injected tasks on at least 17 exposed Cairn agent panels
- Status
- Unverified: only social posts report this so far
- Kind
- Breach
- Vendor
- Cairn
- Product
- Cairn agent panels
- First seen
Summary
NorForge reports finding attacker-queued tasks on at least 17 internet-exposed Cairn agent panels this month, with no exploit needed because the panels were left open. The post says one task installed a Poseidon RAT and others searched for ANTHROPIC_AUTH_TOKEN.
If you use Cairn
Remove direct internet exposure of agent panels and require authentication
Audit task queues for unexpected SSH key installs or commands
Rotate ANTHROPIC_AUTH_TOKEN and any SSH keys on affected agents
Scan hosts for signs of the Poseidon RAT
What the sources say 1
· Mastodon: “NorForge found attacker-injected tasks on at least 17 internet-exposed Cairn agent panels this month.” Source