Cybersecurity firm NorForge identified over 20 malicious instances of the open-source AI engine Cairn exposed publicly on the internet around October 2, 2026.