NorForge (Snorre Fagerland, Oct 19) found more than 20 exposed Cairn control panels used for likely malicious activity. Cairn is an open-source multi-agent "problem-solving" harness: operators set an origin and goal, and agents iterate intents/facts toward that goal. The most active cluster (AIA0001, Chinese-language, high confidence) had 14 panels and 1,100+ attack projects aimed mainly at US/Canada/Japan/Australia e-commerce, seeking unauthenticated RCE and landing an uploader webshell (HTML upload form + move_uploaded_file), not a command-exec shell. Successful goal-met runs averaged under 23 hours and ~140 facts; NorForge estimates ~10% full success and roughly low tens of dollars in tokens per successful task (DeepSeek 4.1 Flash via a Claude Code-style worker name). Reuters, reviewing the same Cairn data, named Deere, SharkNinja, and Cummins among victims; Deere said it remediated with no indication sensitive data was accessed, SharkNinja said a standalone product-support site was hit and contained, Cummins said it is investigating a third-party vendor site. NorForge also saw English-language clusters (AIA0002/0003) chasing cards/crypto, plus legitimate red-team panels left open. Trufflehog over exposed panel data found hundreds of secrets (~11% verified valid). NorForge is working with Reuters on victim notification and panel takedowns.