On 26 October, NorForge, a firm that studies AI agent security, reported that automated campaigns had been slipping malicious tasks into exposed control panels of Cairn, an open-source platform that sends AI agents after a goal. The agents obeyed. This is not a story about commercial testing services. It is a warning for anyone about to let an AI test their systems: an agent is only as safe as the box it runs in, the keys it holds and the people who can talk to it. Here are seven questions to ask first.
What actually happened?
Cairn lets you set a goal and a starting point, and then an AI agent gets to work. Its control panel shows the projects, lets you start or stop tasks, and displays what the agents find. NorForge says the panels it studied had few security mechanisms by default, and many sat open to the internet with no login.
From around 20 October, automated campaigns found those panels and added tasks of their own. One told the agent to add an attacker's SSH key to the machine hosting it. The agent did, and reported back. Other tasks made agents search the host for API keys and tokens, and in one case run a downloaded remote access trojan. NorForge found injected tasks on at least 17 panels. Some belonged to red teams and capture-the-flag exercises, not criminals.
NorForge says the activity was at least scripted and may have been AI-assisted, but it could not confirm that. It also saw attackers probing the agent's container for a way out, and notes that running without a container made their job far easier.
A pentest agent is a special case. It usually holds model API keys, shell access and a network position, and it works from scope documents that describe your systems. If it is taken over, an attacker gains the tester's access and may also gain a map of the weaknesses it was hired to find. That is why the controls around the agent matter as much as the agent's skill.
Does this mean AI pentesting is unsafe?
No. It means an AI agent is a powerful insider with shell access, so it needs the same controls as one. The failure here was exposed panels and weak boundaries on a self-hosted tool, not a flaw in a particular AI model. Managed services can fail in different ways, which is exactly why you should ask. Put these questions to every provider, including us.
Seven questions to ask before an AI tests your systems
1Where do the agents run?
A good answer: Isolated containers or sandboxes, separate from anyone's laptop and from production.
NorForge's own advice is containers with strict limits. Also ask whether your data ever touches a shared machine.
2Who can reach the control panel?
A good answer: Authenticated, private and logged.
In this campaign an open panel handed attackers full control of the agents.
3What can an agent read?
A good answer: Only the credentials it needs for your engagement, short-lived and revocable.
Here, injected tasks told agents to hunt through the host for API keys and tokens.
4Can anyone slip the agent a new task?
A good answer: Tasks come only from authenticated people or approved plans, and risky actions need a human to approve them.
The agent in this case installed an unknown SSH key without question. If you are weighing AI penetration testing, these limits apply to it too.
5Where does your data go?
A good answer: A plain account of which model providers see your data, where findings are stored, for how long, and how they are deleted.
6What is logged, and who reads it?
A good answer: A full record of agent actions, kept for you and reviewed by a person.
7Which human signs off?
A good answer: A named, CREST-certified tester who validates every finding and answers for the report.
Our comparison of autonomous and human pentesting covers the trade-offs. Also ask how fast you will be told if the provider's own tooling is compromised mid-engagement.
What should you do this week?
If you run any self-hosted AI agent platform, check that its panel is not reachable from the internet, put it behind authentication, run tasks in containers and rotate any keys the host could read. If you buy testing from a provider, send the seven questions and ask for written answers. Keep those answers with your supplier records. The NCSC's Cyber Threat Report 2026 tells NZ organisations to assess a supplier's cyber security when they buy, and to seek ongoing assurance afterwards. Your own customers may ask you the same. Ask to see the answers again whenever the provider changes tools or models.
If you are building AI features of your own, the same boundaries apply to them. Our guide to LLM penetration testing covers how to test your own AI product before attackers do.
Book your free PTaaS demo and bring the seven questions. We would rather you ask than assume.
Frequently Asked Questions
What happened to the Cairn AI pentest agent panels?
NorForge reported on 26 October that automated campaigns, active from around 20 October, injected malicious tasks into exposed Cairn control panels. Agents installed an attacker's SSH key, ran a remote access trojan and searched for API keys. NorForge found injected tasks on at least 17 panels, including some run by red teams.
Does this mean commercial AI penetration testing services are unsafe?
No. The incident involved a self-hosted open-source platform whose control panels were left exposed. It does show that an AI agent needs the same controls as a person with shell access. Ask any provider where agents run, who can reach them and what they can read.
What should I ask before an AI agent tests my systems?
Ask where the agents run, who can reach the control panel, what credentials they can read, who can add tasks, where your data goes, what is logged and which human signs off. Ask for written answers and keep them with your supplier records.
Should an AI pentest agent run in a container?
NorForge advises running agent tasks inside containers with strict boundaries. Its report says attackers probed container isolation and found agents running directly on a host far easier to abuse. A container helps, but it does not replace authentication on the panel or limits on the keys an agent can read.
Do I still need a human tester if an AI agent does the testing?
A named, accountable person should validate findings and sign the report. Many auditors expect an independent, dated report, and human review catches false positives and business-logic flaws that automation can miss. A CREST-certified tester provides that accountability.
