Beyond Cairn: The Glass Houses of AI Attackers

Discover what exposed AI attack infrastructure teaches us about the ecosystem.‍

Armadin Findings and the Impact

An entire fleet of autonomous attack tooling is sitting open on the public internet. This gives us a glimpse into how far AI has moved into routine adversary practice. Recent reporting covered one platform, the campaigns run on it, and the victims they produced, but Armadin found 23 more exposed frameworks across more than 3,200 hosts.

Armadin uncovered this segment in hours, with no privileged access, starting from one public report. It is a fraction of what is actually being used by threat actors, and it is likely the work of some of the least sophisticated actors using this technology.

Operators are deploying autonomous pentesting frameworks to the public internet with authentication disabled, bypassed, or left with default configurations. Their control panels serve live campaign data: prompts, target lists, recovered credentials, exfiltrated records, and active command-and-control sessions into victim networks. This is only a sample, but it’s representative of how adversaries are using AI at scale.

While the deployments are simple, the tactics, techniques, and procedures are both sophisticated and effective. If the least-equipped actors are leveraging AI in such effective ways, we can assume that more sophisticated adversaries have found even more compelling ways to enhance their operations with AI.

The public-facing nature of these deployments highlights a second-order risk for organizations that have been breached. Their data is now being exposed, unintentionally, by the culprit of the initial breach. Even if the original breach is remediated, the victim’s data remains exposed.

This reinforces the need for organizations, especially those in critical sectors with access to sensitive data, to harden systems to prevent exploitation. 

What the Agents Did

Reversed custom cryptography by decompiling application binaries when recovered password hashes were not in a standard format, then provisioned GPU clusters on victims’ own cloud accounts to crack them.

Chained SQL injection into code execution by disabling database audit triggers and pivoting across linked database servers, in one case reaching domain-wide access and 25 production databases from a single injection point.

Identified and chained known-exploited vulnerabilities in enterprise middleware without operator direction, including deserialization and file-read paths with fixes available for years.

Defeated CDN and WAF protection by recovering origin addresses from historical DNS and SPF records, padding requests past inspection limits, and spoofing search-engine crawler identities.

Solved audio CAPTCHAs using a speech-to-text model running inside the agent container. The agent chose this route without an operator’s direction because the obstacle was in front of it.

Who They Targeted

Data from over 190 unauthenticated or default-credentialed panels showed autonomous agents scanning and exploiting thousands of targets. These represent various critical infrastructure sectors, including energy, financial services, and telecommunications. Also impacted were large food, media, and technology enterprises, as well as more than 200 consumer retail storefronts and brands across the US, Taiwan, Hong Kong, Canada, Europe, Japan, and Australia. Recorded outcomes across these targets include stolen patient and employee records, Active Directory compromise, persistent storefront web shells, automated harvesting of customer orders and PII, and live command-and-control sessions on internal servers and network hardware.

Recommended Actions

1. Pressure-test your external surface with AI tools. The defender’s window is rapidly closing and it is critical to find and fix external-facing vulnerabilities ahead of adversaries. As threat actors expand their use of AI, we expect to see additional surges in offensive operations that find and exploit vulnerabilities at an unprecedented pace and scale. 
2. Assume your stolen data is still being read. In every case we found, stolen data was still sitting on the attacker’s open panel, readable even after the breach was remediated. For each past compromise, identify any information that is still relevant, and ensure you’re hardened against it.
3. Your agentic tools may share these weaknesses. We found more than 130,000 general-purpose agent harnesses exposed the same way as these attack frameworks. Check your own for interfaces listening on all addresses, datastores reachable from the internet, and authentication that turns off when a key or setting is missing.

Stay Ahead of Whatever Threats May Come

AI-driven threats require a new approach to keep environments secure. Learn more about safe, controlled Hyperattacks from Armadin.

‍