OTX Threat: Automated Subversion and Attempted Takeover of AI Pentesting Harnesses

Unprotected Cairn AI intrusion harnesses are being systematically compromised by unknown actors through automated campaigns that began around October 20, 2026. Attackers insert malicious tasks that manipulate agents to compromise the host systems, involving profiling installations, stealing secrets including AI model API keys, downloading Poseidon malware, and installing unauthorized SSH keys. Two