The control panel behind a 100-site AI hacking spree has no login. I ran one.
---
published: true
description: Reuters watched an AI-agent spree breach 100+ companies at roughly fifty dollars a break-in. The open-source control plane behind it, Cairn, ships without authentication — I read the source, then ran one with the attack mode off — four commands, no API key — and read the whole blackboard.
tags: ai, security, python, devops
series: receipts
---
INFO scheduler.loop dispatched bootstrap project=proj_001 intent=i001 worker=mock-observer-1
INFO tasks.common intent concluded project=proj_001 intent=i001 worker=mock-observer-1 source=bootstrap phase_ms=3000 total_ms=3002
INFO tasks.bootstrap bootstrap completed project=proj_001 intent=i001 worker=mock-observer-1 source=bootstrap from=['f001'] phase_ms=3000 total_ms=3002
INFO scheduler.loop skip project=proj_001 because status=completed
INFO scheduler.loop skip dispatch because no active projects
That is an autonomous agent swarm bootstrapping itself on my laptop, and the whole loop took three seconds. The software is Cairn, the open-source control plane that Reuters reports sat underneath a hacking spree that breached more than a hundred companies at something like fifty dollars a break-in. I ran it with the attack machinery off — no API keys, no Docker, no packets leaving the machine — because the interesting part of this story is not the breach. It is that the control panel behind it has no login. Not a weak login. No login anywhere in the source.
The spree a researcher watched from inside the panel
The story, as Reuters told it on October 19: Snorre Fagerland, principal threat researcher at the security company NorForge, spent early October scanning for accidentally exposed Cairn instances and found about two dozen being used for malicious activity, which let him "quietly peer over the cybercriminals' shoulders" while they worked. The most prolific was a Chinese-speaking hacker, active since September 25, aimed at US, Canadian, Australian and Japanese e-commerce sites. Their entire campaign plan fit in fewer than 100 Chinese characters. The agents did the rest: more than 1,200 sites attempted, more than 100 companies compromised, successful intrusions typically taking around 23 hours of probing, for roughly $5,000 in tokens across the whole campaign — about $50 per successful hack — on a mixture of China's DeepSeek and Anthropic's Claude Code.
The part Fagerland said impressed him was not the volume. In one case, after the agents failed to find a weakness in a large company's public-facing application, they dug through digital records to map associated infrastructure, located a public-facing control panel, found a subtle flaw in how it processed data, and ground through hours of trial and error until the server executed their commands. "It's not straightforward to come up with solutions like that," he told Reuters. "It's not script kiddie stuff." His summary of the state of the world: "It's a new world now."
The named victims read like a list of companies that did nothing unusual. Deere said it took "necessary remediation actions" and has "no indication that sensitive information was accessed." SharkNinja said the hit landed on a standalone product-support site and has been contained. Cummins said it was "investigating the report of a potential cyber-attack on a website operated by one of our third-party vendors." Reuters could not determine whether any data was actually extracted, and two smaller businesses acknowledged compromise on top of the three above. Nobody in this story needed to click anything.
A blackboard, three primitives, and no lock
Cairn's README is upfront about the ambition: "a general-purpose AI state-space search engine, validated first on autonomous penetration testing" (and, charmingly, "Sometimes misspelled as Carin"). You give it an origin and a goal, and it searches for a path through an unknown state space. The engine is a blackboard with three primitives: a Fact is a confirmed finding written to the board, an Intent is a declared direction of exploration not yet executed, and a Hint is human judgment injected at any point, absorbed by the agents on their next read. Workers run an OODA loop — observe the full graph, orient, decide on the next intents, act — with no fixed roles, and the supported backends are the Claude Code, Codex and Pi CLIs. That is exactly the shape of the Reuters campaign: terse human instructions, hours of autonomous traversal, a board filling up with findings.
Here is the part I verified myself rather than taking from the wire. The current release, v0.2.1, ships its entire API server as a forty-line FastAPI file: five routers, sixteen endpoints, and not one of them asks who is calling. No auth middleware. No credential dependency. No API key option anywhere in the server package. The API even describes itself at /openapi.json to anyone who connects — I counted the sixteen routes on my own instance. Fagerland's phrase was "inadvertently exposed instances"; the code explains how inadvertent they were. A Cairn deployment that is reachable is a Cairn deployment that is readable, writable, and taking hints from strangers. My contribution to the record is narrow but solid: I read the shipped source, and nothing in it would have stopped the researcher. The exposure was a deployment failure sitting on top of a platform that never gated anything in the first place.
The author, who posts as le1xia0, told Reuters the platform is "an innovative type of multi-agent architecture and was not designed for hacking attacks. If it is used to carry out harmful hacking attacks, that is not my intention." Both halves of that sentence are consistent with the code: it is a general search engine, and it validates itself on penetration testing because origin-goal-path problems are what pentesting is.
September already priced this
Reuters is not the first instrument to read this thermometer. On September 22, Gambit Security's threat intelligence team published its own reconstruction of a separate spree hitting online retailers, built on the same trio: Strix for reconnaissance (146 runs against 138 hosts, 633 scanner-hours in August alone), Cairn for autonomous intrusion (105 attack projects launched between September 10 and 15, running on DeepSeek v4.1 Flash), and Hermes as the orchestration console — persistent memory, self-written skills, and a Chinese-language "SOUL - Red Team Operator" persona loaded with 121 skills, 78 of them attack-related. One of those skills was titled Database Wipe After Extraction. At one victim, a bicycle retailer, the cleanup dropped 180 tables, including the victim's own backups.
The economics from that report are the number I cannot stop thinking about: $25.46 average marginal cost per completed scan, across 101 scans, ranging from $3.13 to $79.31, on a total model bill estimated at $12,000 to $18,000 over seven weeks.
| figure | value | who measured it |
|---|---|---|
| sites attempted | 1,200+ | NorForge, from exposed Cairn instances |
| companies compromised | 100+ | NorForge; Reuters identified Deere, SharkNinja, Cummins |
| median time to a successful intrusion | ~23 hours | NorForge |
| whole-campaign token bill | ~$5,000 | NorForge estimate |
| cost per success | ~$50 | NorForge |
| cost per completed scan (separate spree) | $25.46 avg, $3.13–$79.31 | Gambit Security, 101 scans |
| model bill (separate spree) | $12k–18k over ~7 weeks | Gambit Security |
Two research firms, two campaigns, no shared data, same order of magnitude: tens of dollars per breach. When two independent instruments agree that hard, the interesting fact stops being either instrument and becomes the price.
The counterpoint: the model is the moat
Before this reads like every model can do this now, there is a corrective data point, and it comes from someone who tried the benign version in good faith. A Japanese maintainer built an open defensive study of these exact tools — detection rules, triage tooling, a lab runbook — and documented an honest, failed attempt to run the recon agent (Strix) end-to-end against their own isolated lab. Local CPU models produced malformed tool-call JSON or pointless command loops. Groq's free tier hit per-minute token caps no model choice avoided. OpenRouter's free tier passed isolated test calls but reproducibly 404'd on the agent's real request size. The conclusion was to drop agent-based scanning entirely and ship a deterministic scanner instead — which immediately found what the agent could not.
Set that next to what the successful sprees ran: Claude Code as the harness, DeepSeek v4.1 Flash as one of the engines. Cheap does not mean toy-grade. It means the expensive part of the intrusion moved into the model bill, and the sprees that worked all paid it. The moat is no longer the exploit skill. It is the model behind the loop — which is a strange sentence to write, and the numbers above are why it is the right one.
Running the panel with the teeth off
You can watch this architecture work on your own machine in four commands, with the offensive half disabled. Cairn ships a mock worker type that throws weighted dice instead of calling a model — same board, same loop, same protocol, zero API keys, zero network. Here is the exact configuration of my run, paste it as cairn-mock.yaml:
server: "http://127.0.0.1:8000"
runtime:
execution: local # workers as host processes — the container default needs Docker
worker_healthcheck: disabled
max_workers: 2
max_running_projects: 2
max_project_workers: 2
interval: 3
healthcheck_timeout: 5
prompt_group: "mock"
tasks:
bootstrap: {timeout: 9, conclude_timeout: 5}
reason: {timeout: 5, max_intents: 3}
explore: {timeout: 9, conclude_timeout: 5}
local:
completed_action: keep
workers:
- name: "mock-observer-1"
type: "mock"
task_types: [reason, explore, bootstrap]
max_running: 1
priority: 0
env:
MOCK_HEALTHCHECK: '{"delay":[0,1],"outcomes":{"ok":1.0}}'
MOCK_BOOTSTRAP: '{"delay":[1,3],"outcomes":{"complete":1.0,"fact":0.0}}'
MOCK_REASON: '{"delay":[1,3],"outcomes":{"intent":0.7,"noop":0.3}}'
MOCK_EXPLORE_EXECUTE: '{"delay":[1,3],"outcomes":{"fact":1.0}}'
MOCK_EXPLORE_CONCLUDE: '{"delay":[1,2],"outcomes":{"fact":1.0}}'
git clone https://github.com/oritera/Cairn && cd Cairn
python3 -m venv .venv && .venv/bin/pip install -e ./cairn
.venv/bin/cairn serve --host 127.0.0.1 --port 8000 # terminal 1
.venv/bin/cairn dispatch --config cairn-mock.yaml # terminal 2
Seed the board — note the API wants a title now, which older community runbooks do not mention:
curl -s -X POST http://127.0.0.1:8000/projects -H 'Content-Type: application/json' \
-d '{"title":"mock lab","origin":"target http://10.77.0.10 (isolated lab, unreachable)","goal":"get a shell"}'
The response, verbatim from my run:
{"project":{"id":"proj_001","title":"mock lab","status":"active","bootstrap_enabled":true,"created_at":"2026-10-20T16:41:50Z","reason":null},"facts":[{"id":"origin","description":"target http://10.77.0.10 (isolated lab, unreachable)"},{"id":"goal","description":"get a shell"}],"intents":[],"hints":[]}
Wait about forty seconds, then read the board back with one unauthenticated curl — which is, again, the entire point:
{"project": {"id": "proj_001", "status": "completed"},
"facts": [
{"id": "origin", "description": "target http://10.77.0.10 (isolated lab, unreachable)"},
{"id": "goal", "description": "get a shell"},
{"id": "f001", "description": "mock fact for bootstrap"}],
"intents": [
{"id": "i001", "description": "bootstrap"},
{"id": "i002", "description": "mock bootstrap complete from fact"}],
"hints": []}
Two practical notes from stepping on both rakes so you do not have to. The default dispatch mode runs one Docker container per project, and the published worker image has no ARM64 manifest, so on an Apple Silicon machine the default fails — execution: local in the config above is the way through. And the real intrusions Fagerland timed averaged 23 hours; mine finished in three seconds, because the stakes were dice. The speed is not the point. The shape is: same board, same loop, same protocol, and the same complete absence of a gate between the board and whoever finds the port.
!blackboard
The rung this sits on
The authority ladder this series keeps coming back to says evidence that lives on infrastructure you do not control is a caller label. An exposed agent control plane is that failure inverted and pointed at you: your agent's findings, plans, and hints sitting on a board that describes itself to whoever connects. Last week's post was about a bypass that got logged; this one is about a door that was never installed. Both receipts come from the same place — reading what the software actually does instead of what the deployment assumes.
What to steal
- Audit your own control planes with one curl. From outside the network segment where an agent control plane is supposed to live, ask for GET /openapi.json. An answer means the panel describes itself, its routes, and its data model to whoever asks. Bind to loopback, or gate it behind the same VPN as everything else you would hate to lose — do not rely on the software to ship a gate.
- The detection pack already exists. The Japanese defensive study ships Sigma, Falco and Datadog rules (R1–R8) mapped to MITRE ATT&CK/ATLAS and the OWASP Top 10 for LLM, built specifically for agent attack chains — recon, intrusion, orchestration. Free, and written by someone who verified their own work against live tooling.
- Egress control on the workers is the real prevent layer. Gambit's report and every mitigation list in this space converge there: an agent that can only reach the destinations you allow cannot map your associated infrastructure at 3 a.m. Disclosure, because receipts series: NorForge, Fagerland's employer, sells agent egress controls, and its full report was not yet public when this post was written. The finding stands on the code; the incentives are stated so you can weigh them.
- Steal the Hint primitive for your own tools. The one place a human joins Cairn's loop, the judgment lands on the board with everything else — versioned, timestamped, absorbed downstream. Dashboards show what is happening; boards record it.
Two honest limits
The mock proves the control plane, not the spree. My run generated facts with dice; no attack was executed against any target, full stop. The 1,200 attempted sites, the 100+ compromises, the 23-hour median and the $5,000 token bill are the researcher's estimates from observed telemetry on exposed instances — not court records — and Reuters explicitly could not determine whether data was extracted. The named companies' statements above are the other half of that uncertainty, and they belong in every retelling.
My no-auth finding is a code read, not a scan. I read Cairn v0.2.1 as published on GitHub and verified the server package ships no authentication; I did not probe anyone's deployment. The release I read was the repo's state as of its last push on September 7 — three days before the September 10–15 attack window Gambit documented — which cuts both ways: it is almost certainly what ran in the field, and a repo can ship an auth layer any day now, so check the source before quoting anyone, including me. The economics table mixes two independent campaigns with different tooling and different victims; they agree on order of magnitude, not on identity, and I have kept them in separate rows for exactly that reason.
Your turn
Run the four commands, seed a project, and let the mock loop chew for a minute. Then post two numbers in the comments: your fact count after sixty seconds of dispatch — the dice are weighted, not scripted, so your board will not match mine, and the divergence is the loop working as designed — and the number of agent control planes on your own network that answer /openapi.json from outside their intended segment. My pair is (3 facts, 1 panel on loopback where I put it). The first number tells you what autonomous traversal looks like when nothing is at stake. The second tells you whether anything of yours is currently keeping its findings on an unlocked board.
1 reaction
Mentions
I wonder what would happen if you plugged in something like "synthesise mirror life" or "kill all humans" as the goal in Cairn
Its been a nasty month for security and its never this important for companies to align the tooling and infra with security. We should have envs where companies can deploy agents and do penetration testing. oritera/Cairn this one is one OS version where attackers have used. We should start doing agentic pen testing before attackers do.
1,600 AI Attack Projects Visible Through Unprotected Panels: Erlend Oftedal at [un]prompted 2026 Attackers pointing autonomous agents at targets forgot to password-protect the control panel, leaving their operations readable from the internet. More than 20 exposed panels turned up for Cairn, an AI harness that takes a target along with a goal, then runs agents until it gets there. Each panel exposes a full operation: target selection, the literal task prompts, every step the agents took, and the outcome. The economics come straight off those panels. Criminal clusters ran over 1,600 attack projects against 1,100 e-commerce sites at roughly $5 each, with around 10 percent succeeding, typically inside a day. In his [un]prompted 2026 talk, "Inside Cairn: Open Windows Into AI Attacks," on Tuesday, October 27 at 2:45 p.m. on Stage 2, Erlend Oftedal walks through what the attackers did, their tooling, along with the exploit chains the agents assembled from small bugs. Speaker: Erlend Oftedal The exposed panels gave an unusual view into attacker decision-making. Reading the literal task prompts shows how an operator framed a goal, while the step logs show which paths the agents abandoned. NorForge published the underlying research as Inside Cairn, tracking a most-active cluster as AIA0001 that linked 14 panels to more than 1,100 projects. The Hacker News attributes the panel discovery to NorForge's Snorre Fagerland, who scanned the internet for exposed Cairn instances. Reuters reported the campaign economics separately. Its account describes a Chinese-speaking actor whose Cairn agents attempted more than 1,200 sites, reaching websites of more than 100 companies, with Fagerland estimating around $5,000 in total token spend. Erlend Oftedal has worked for more than 20 years as a developer, security researcher and security engineer. He is the main author of Retire.js, the scanner that flags JavaScript libraries with known vulnerabilities, distributed on npm as the retire package. He has led the OWASP Oslo chapter for over a decade, and he maintains several open source security tools. His work spans software development, security architecture, penetration testing along with code review. He taught two sessions at SecAppDev 2024, including the keynote AppSec is changing, and he gave "Beyond the OWASP Top 10" at NDC Security 2018. He sits on the NDC Oslo agenda committee, and he is based in Oslo. To go deeper on the topic, start here: - Inside Cairn (NorForge research) - Hackers use autonomous AI agents to breach company websites (The Hacker News) - Reuters: how one hacker used AI agents and a few thousand dollars to break into scores of sites - Cairn AI attacks: open control panels exposed webshells and secrets (Gridinsoft) - Cairn project repository - Erlend Oftedal, SecAppDev 2024 keynote slides Anyone defending an e-commerce site gets a per-target cost figure for automated attacks, which is the number that sets how often they arrive. At roughly $5 per attack attempt, how many times a day would your site need to be probed before your detection noticed?
I managed to get the Cairn (oritera/Cairn) engine glued to my local ODS (Osmantic/ODS) instance Cairn now exclusively uses my local LLMs to drive its processing Next goal is to craft custom n8n workflows that feed projects to Cairn based upon outcomes
oritera/Cairn: Cairn is a general-purpose AI state-space search engine, validated first on autonomous penetration testing. Sometimes misspelled as Carin.
AIペネトレーションテストツール「Cairn」を試してみた はじめに 前回の記事（AIペネトレーションテストツール「Strix」を試してみた）で、自律型AIペンテストツールの一例としてStrixを実際に動かし、OpenAIをバックエンドにしたブラックボックス診断の結果をまとめました。あの記事の冒頭で、攻撃者がStrixやCairnのようなペネトレーションテストツールをHermes agentのような自律エージェント基盤上で運用しているらしい、という話に触れましたが、今回はもう一方の「Cairn」を実際に使ってみます。 CairnはStrixと違い、ペンテスト専用ツールではなく「汎用の状態空間探索エンジン」を名乗っています。出発点（Origin）と目標（Goal）さえ決まっていれば、その間の未知の経路をAIエージェントが探索する、という枠組みそのものを提供しており、ペネトレーションテストはその最初の検証用途という位置付けです。実際、Tencent Cloud Hackathonのペネトレーションテスト部門では610チーム中、54問全問を正解した唯一のチームとして総合3位を獲得しており、実力は折り紙付きです。 検証対象は前回と同じ、自作の「あえて脆弱性を仕込んだECサイト風のRailsアプリ」です。今回はOpenAIではなく、Claude Codeのサブスクリプションをそのまま使う構成で試しました。 Cairnとは Strixが「偵察・攻撃・検証を担当するエージェントがチームで動く」という固定的なマルチエージェント構成だったのに対し、Cairnはもう少し抽象度の高い作りになっています。 Blackboard Architecture（共有黒板方式）: Fact（確定した事実）、Intent（まだ実行していない探索方向）、Hint（人間が随時注入できる助言）の3つだけでグラフを構成する ロール固定なし: ワーカーに「偵察担当」「攻撃担当」のような役割は無く、グラフの現在の状態からタスクがその都度動的に生成される Stigmergy（間接協調）: エージェント同士は直接会話せず、共有された黒板（グラフ）を介してのみ協調する ワーカーの中身を選べる: Claude Code、Codex、Piのいずれかをバックエンドにできる システム構成は、Cairn Server（Fact/Intent/Hintのグラフを保持するだけ）、Dispatcher（グラフを読んでタスクをスケジュールし、ワーカーを起動する）、Worker（実際にプロンプトを受け取って探索するClaude Code等のCLI）の3層に分かれています。 Cairn Server（Fact / Intent / Hint のグラフ） ↑ ポーリング Cairn Dispatcher（タスクをスケジュール、ワーカーを起動） ↓ 起動 Worker（ローカルのclaude CLI、またはDockerコンテナ内のclaude/codex/pi） セットアップ（ローカルモード、Claude Codeを利用） CairnにはDockerで各プロジェクトをコンテナ化する方式と、ホスト上のCLIをそのまま使う「ローカルモード」があります。今回はローカルモードを使いました。 git clone oritera/Cairn cd Cairn cp dispatch.local.example.yaml dispatch.yaml この位置でターミナルを2つ開いて下記のコマンドを実行します。 ターミナル1: APIサーバー uv run --project cairn cairn serve ターミナル2: ディスパッチャー uv run --project cairn cairn dispatch --config dispatch.yaml 私はiTerm2（ターミナルソフト）を使っているので画面を分割していますが、こんな感じです。 ローカルモードの最大の特徴は、dispatch.yamlにAPIキーが一切出てこないことです。このマシンに既にログイン済みのclaude CLIをサブプロセスとして呼び出すだけなので、Claude Codeのサブスクリプション（Pro/Maxプラン）をそのまま使えます。Strixのように別途OpenAIの従量課金APIキーを用意する必要がありません。ただし、裏でLLM呼び出しが発生していること自体は変わらないので、サブスクリプションの利用枠やレート制限は消費します。 なお、ローカルモードはサンドボックスなしでホストユーザーの権限のまま動きます。隔離されたラボ環境専用で使うべき設計です。 プロジェクト（探索タスク）を投げる Cairn ServerにはシンプルなWeb UI（http://127.0.0.1:8000）が組み込まれており、ブラウザからプロジェクトを作成できます。 同じことはAPIからも直接できます。 curl -s -X POST 127.0.0.1 \ -H "Content-Type: application/json" \ -d '{ "title": "huckme-rails pentest", "origin": "対象はhttp://localhost:3000で動くRailsのECサイト。未認証でアクセス可能で、一般会員として alice@huckme.local / password123 でログインもできる。", "goal": "一般会員権限のまま、管理者しか知り得ない他ユーザーの情報や管理機能に到達できることを示すPoCを作り、発見した脆弱性ごとに再現手順をレポートせよ。", "bootstrap_enabled": true }' Web UIから作成してもcurlから作成しても、裏で動いているのは同じAPIなので、Dispatcherが拾って処理する内容は変わりません。Web UIはFact/Intentのグラフをノードとエッジで可視化してくれるビューアとしてだけ使い、プロジェクト自体は手慣れたcurlで投げる、という使い方もできます。 進行中は、ノードをクリックするとそのFactの全文が読めるほか、「Log」タブでプロジェクト作成からFact確定までの流れを時系列ログとして追えます。 ただし「レポートを開く」ボタンのようなものは無く、UIが見せてくれるのはあくまでCairnサーバーが持つFact/Intentの構造化データです。 1回目: 指示なしで走らせてみる 最初は何も気にせず、素直なoriginとgoalだけでプロジェクトを作成しました。結果は上々で、以下が実際に悪用可能なPoCとして確認されました。 /invoices/:idのIDOR（他ユーザー・管理者の注文を閲覧） /documents/downloadのパストラバーサルでmaster.key、アプリのソースコード一式、そしてSQLiteのDBファイル自体を丸ごと奪取 新規登録フォームのroleパラメータ経由のマスアサインメントで、登録しただけの新規アカウントが即座にadmin権限を取得 面白かったのは、パストラバーサルで読んだソースコードから、エージェントが自分で次の攻撃仮説（コマンドインジェクション、SSRF、SQLi）を立てて個別のIntentに分解し、順番に検証していった点です。人間のペンテスターが「ソースを読んで次を考える」という動きをそのまま再現しているように見えました。 一方で、Factの内容はすべて英語で書かれていました。origin/goalは日本語で入力したのに、ワーカーが書く調査結果は英語になる、というのは前回のStrixと同じ現象です。実際にCairnのプロンプトテンプレート（cairn/src/cairn/dispatcher/prompts/default/*.md）を確認したところ、指示文はすべて英語固定で、出力言語を指定する仕組みはどこにもありませんでした。 日本語化してみる Strix記事での知見（--instructionに日本語で書けば効く）と同じ発想で、originかgoalの文中に直接「日本語で書け」と混ぜ込んでみました。 curl -s -X POST 127.0.0.1 \ -H "Content-Type: application/json" \ -d '{ "title": "huckme-rails pentest (ja)", "origin": "対象はhttp://localhost:3000で動くRailsのECサイト。一般会員 alice@huckme.local / password123 でログイン可能。すべてのFactおよび最終レポートは日本語で記述すること。", "goal": "一般会員権限のまま、/diagnostics/ping のOSコマンドインジェクションと /diagnostics/fetch_url のSSRFが実際に悪用可能であることを示すPoCを作り、発見内容を日本語でレポートせよ。", "bootstrap_enabled": true }' 結果、今度はFactもIntentの説明文もすべて日本語で生成されました。SSRFの検証では、外部URL・ループバックアドレス・閉じたポート・クラウドメタデータっぽいアドレスへのリクエストを試し、「即座に内容が返る」「即座に接続拒否される」「約60秒でタイムアウトする」という応答差から、単なる情報漏えいだけでなく内部ネットワークのポートスキャンにも使える、という評価まで日本語で書かれていました。 ただし、1回目では自発的にVULNERABILITY_REPORT.mdというMarkdownファイルを書き出していたのに対し、この2回目ではファイルは一切作られず、Factの説明文がレポート内容を兼ねるだけで終わりました。同じように出力先を指定しない書き方でも挙動が変わる、つまりMarkdownファイルとして残すかどうかはワーカー任せで非決定的だということが分かりました。ファイルとして確実に欲しい場合は、goalに出力先を明示する必要があります。 3回目: goalを練り直して本番投入 ここまでの知見（日本語指示を入れる、出力先を明示する、特定の脆弱性に絞らず広く探索させる）をすべて反映したgoalを組み立てて、最初からやり直しました。 origin: 対象はhttp://localhost:3000で動くRailsのECサイト「HuckMe Shop」。未認証でもアクセス可能で、 一般会員として alice@huckme.local / password123 でログインできる。(中略)すべてのFactおよび最終 レポートは日本語で記述すること。 goal: 一般会員権限、または新規登録のみで到達できる範囲で、管理者しか知り得ない情報や管理機能に到達 できること、またはアプリケーションサーバー上で任意の操作ができることを示すPoCを、発見できる限り多く 作成せよ。(中略)最終的な調査結果は、Markdown形式で /tmp/huckme_cairn_v3/report.md に書き出すこと。 結果は18件のFact・18件のIntentを消化し、指示通りreport.mdが確実に生成されました。内容は仕込んでおいた脆弱性をほぼ完全に網羅しているだけでなく、こちらが想定していなかった攻撃チェーンまで自力で組み立てていました。 具体的には、パストラバーサルで奪取したmaster.keyからcredentials.yml.encを復号してsecret_key_baseを取得し、Railsのクッキー署名方式（salt・cipher・purpose）をソースコードから特定した上で、本物のログイン済みセッションクッキーを復号してuser_idだけ書き換えて再暗号化する、というクッキー偽造によるadmin権限奪取を実際のHTTPリクエストで成功させていました。しかも最初の試行は失敗しており、「URLエンコーディングの不一致」「偽造ペイロードの構造不足」という2つの原因を切り分けてから再挑戦して成功させる、という試行錯誤の過程までレポートに残っていました。 これは本番ではmaster.keyをファイルではなく環境変数で注入するのが定石であり、本検証はその重要性を裏付ける結果でもあります。 最終的にレポートがもっとも重大と判定したのは次の4件です。 新規登録フォームでのマスアサインメント権限昇格（user[role]=adminの1パラメータだけで未認証状態からadmin権限を恒久取得。もっとも攻撃コストが低い経路として明記） /diagnostics/pingのOSコマンドインジェクション（root権限での任意コマンド実行） secret_key_base奪取によるクッキー偽造でのadmin権限奪取 Admin::UsersController#indexのSQLインジェクション（UNIONベースで全ユーザーのSSN・カード番号まで抽出） SQLiについても、1回目はブラインドSQLi検出止まりだったのに対し、3回目はUNIONベースでのデータ抽出まで踏み込んでおり、goalの書き方次第で深掘りの度合いが大きく変わることが実感できました。 Strixとの比較 同じ対象に対して両方を試してみた感触としては、役割がかなり違う印象でした。 Strixは「とりあえずURLを渡せば動く」手軽さと、TUIでの進捗可視化、レポートの体裁が最初から整っている完成度の高さが強みです。一方Cairnは、プロジェクトの作り方（origin/goalの書き方）でアウトプットの質が大きく変わる、良くも悪くも素材寄りのツールという印象を受けました。その分、こちらが明示していない攻撃チェーン（クッキー偽造）を自力で発見・実証するような、踏み込んだ探索ができたのも事実です。 運用面では、Cairnはローカルモードを使えばAPIキーなしで既存のClaude Codeサブスクリプションに乗れる点がStrixに対する明確な利点です。反面、ローカルモードはサンドボックスが無くホスト権限でそのまま動くため、隔離環境を用意する責任はこちらに移ります。また、探索の過程でAPIキーの実際の値や機密情報がCairnのSQLite DBやローカルディスクに平文で残る点、テスト用に自己登録したアカウントがそのままDBに残る点は、使い終わったら片付けが必要な運用上の注意点です。 まとめ Cairnはペンテスト専用ツールではなく、Fact/Intentのグラフを使った汎用の状態空間探索エンジンで、ペンテストはその最初の実証用途 ローカルモードならDockerもAPIキーも不要で、既存のClaude Codeサブスクリプションをそのまま使える 出力言語もレポートファイルの有無も、goal/originの書き方次第でワーカーの挙動が変わる。確実性が欲しいなら明示的に指示するしかない goalを練り込むほど深掘りの質が上がり、最終的にはこちらが想定していなかったクッキー偽造の攻撃チェーンまで自力で組み立てて実証してきた Strixが「手軽に素早く」なら、Cairnは「書き方次第でどこまでも深掘りできる」という棲み分けに感じた 前回のStrix、今回のCairnと2つの自律型ペンテストツールを試してきましたが、どちらも「攻撃側の視点を先回りして使う」という目的には十分応える完成度でした。攻撃者が実際にこうしたツールを使っているとすれば、防御側も同じ土俵のツールで自分のアプリを定期的に叩いておく価値は大きいと感じています。
The control panel behind a 100-site AI hacking spree has no login. I ran one. --- published: true description: Reuters watched an AI-agent spree breach 100+ companies at roughly fifty dollars a break-in. The open-source control plane behind it, Cairn, ships without authentication — I read the source, then ran one with the attack mode off — four commands, no API key — and read the whole blackboard. tags: ai, security, python, devops series: receipts --- INFO scheduler.loop dispatched bootstrap project=proj_001 intent=i001 worker=mock-observer-1 INFO tasks.common intent concluded project=proj_001 intent=i001 worker=mock-observer-1 source=bootstrap phase_ms=3000 total_ms=3002 INFO tasks.bootstrap bootstrap completed project=proj_001 intent=i001 worker=mock-observer-1 source=bootstrap from=['f001'] phase_ms=3000 total_ms=3002 INFO scheduler.loop skip project=proj_001 because status=completed INFO scheduler.loop skip dispatch because no active projects That is an autonomous agent swarm bootstrapping itself on my laptop, and the whole loop took three seconds. The software is Cairn, the open-source control plane that Reuters reports sat underneath a hacking spree that breached more than a hundred companies at something like fifty dollars a break-in. I ran it with the attack machinery off — no API keys, no Docker, no packets leaving the machine — because the interesting part of this story is not the breach. It is that the control panel behind it has no login. Not a weak login. No login anywhere in the source. The spree a researcher watched from inside the panel The story, as Reuters told it on October 19: Snorre Fagerland, principal threat researcher at the security company NorForge, spent early October scanning for accidentally exposed Cairn instances and found about two dozen being used for malicious activity, which let him "quietly peer over the cybercriminals' shoulders" while they worked. The most prolific was a Chinese-speaking hacker, active since September 25, aimed at US, Canadian, Australian and Japanese e-commerce sites. Their entire campaign plan fit in fewer than 100 Chinese characters. The agents did the rest: more than 1,200 sites attempted, more than 100 companies compromised, successful intrusions typically taking around 23 hours of probing, for roughly $5,000 in tokens across the whole campaign — about $50 per successful hack — on a mixture of China's DeepSeek and Anthropic's Claude Code. The part Fagerland said impressed him was not the volume. In one case, after the agents failed to find a weakness in a large company's public-facing application, they dug through digital records to map associated infrastructure, located a public-facing control panel, found a subtle flaw in how it processed data, and ground through hours of trial and error until the server executed their commands. "It's not straightforward to come up with solutions like that," he told Reuters. "It's not script kiddie stuff." His summary of the state of the world: "It's a new world now." The named victims read like a list of companies that did nothing unusual. Deere said it took "necessary remediation actions" and has "no indication that sensitive information was accessed." SharkNinja said the hit landed on a standalone product-support site and has been contained. Cummins said it was "investigating the report of a potential cyber-attack on a website operated by one of our third-party vendors." Reuters could not determine whether any data was actually extracted, and two smaller businesses acknowledged compromise on top of the three above. Nobody in this story needed to click anything. A blackboard, three primitives, and no lock Cairn's README is upfront about the ambition: "a general-purpose AI state-space search engine, validated first on autonomous penetration testing" (and, charmingly, "Sometimes misspelled as Carin"). You give it an origin and a goal, and it searches for a path through an unknown state space. The engine is a blackboard with three primitives: a Fact is a confirmed finding written to the board, an Intent is a declared direction of exploration not yet executed, and a Hint is human judgment injected at any point, absorbed by the agents on their next read. Workers run an OODA loop — observe the full graph, orient, decide on the next intents, act — with no fixed roles, and the supported backends are the Claude Code, Codex and Pi CLIs. That is exactly the shape of the Reuters campaign: terse human instructions, hours of autonomous traversal, a board filling up with findings. Here is the part I verified myself rather than taking from the wire. The current release, v0.2.1, ships its entire API server as a forty-line FastAPI file: five routers, sixteen endpoints, and not one of them asks who is calling. No auth middleware. No credential dependency. No API key option anywhere in the server package. The API even describes itself at /openapi.json to anyone who connects — I counted the sixteen routes on my own instance. Fagerland's phrase was "inadvertently exposed instances"; the code explains how inadvertent they were. A Cairn deployment that is reachable is a Cairn deployment that is readable, writable, and taking hints from strangers. My contribution to the record is narrow but solid: I read the shipped source, and nothing in it would have stopped the researcher. The exposure was a deployment failure sitting on top of a platform that never gated anything in the first place. The author, who posts as le1xia0, told Reuters the platform is "an innovative type of multi-agent architecture and was not designed for hacking attacks. If it is used to carry out harmful hacking attacks, that is not my intention." Both halves of that sentence are consistent with the code: it is a general search engine, and it validates itself on penetration testing because origin-goal-path problems are what pentesting is. September already priced this Reuters is not the first instrument to read this thermometer. On September 22, Gambit Security's threat intelligence team published its own reconstruction of a separate spree hitting online retailers, built on the same trio: Strix for reconnaissance (146 runs against 138 hosts, 633 scanner-hours in August alone), Cairn for autonomous intrusion (105 attack projects launched between September 10 and 15, running on DeepSeek v4.1 Flash), and Hermes as the orchestration console — persistent memory, self-written skills, and a Chinese-language "SOUL - Red Team Operator" persona loaded with 121 skills, 78 of them attack-related. One of those skills was titled Database Wipe After Extraction. At one victim, a bicycle retailer, the cleanup dropped 180 tables, including the victim's own backups. The economics from that report are the number I cannot stop thinking about: $25.46 average marginal cost per completed scan, across 101 scans, ranging from $3.13 to $79.31, on a total model bill estimated at $12,000 to $18,000 over seven weeks. | figure | value | who measured it | |---|---|---| | sites attempted | 1,200+ | NorForge, from exposed Cairn instances | | companies compromised | 100+ | NorForge; Reuters identified Deere, SharkNinja, Cummins | | median time to a successful intrusion | ~23 hours | NorForge | | whole-campaign token bill | ~$5,000 | NorForge estimate | | cost per success | ~$50 | NorForge | | cost per completed scan (separate spree) | $25.46 avg, $3.13–$79.31 | Gambit Security, 101 scans | | model bill (separate spree) | $12k–18k over ~7 weeks | Gambit Security | Two research firms, two campaigns, no shared data, same order of magnitude: tens of dollars per breach. When two independent instruments agree that hard, the interesting fact stops being either instrument and becomes the price. The counterpoint: the model is the moat Before this reads like every model can do this now, there is a corrective data point, and it comes from someone who tried the benign version in good faith. A Japanese maintainer built an open defensive study of these exact tools — detection rules, triage tooling, a lab runbook — and documented an honest, failed attempt to run the recon agent (Strix) end-to-end against their own isolated lab. Local CPU models produced malformed tool-call JSON or pointless command loops. Groq's free tier hit per-minute token caps no model choice avoided. OpenRouter's free tier passed isolated test calls but reproducibly 404'd on the agent's real request size. The conclusion was to drop agent-based scanning entirely and ship a deterministic scanner instead — which immediately found what the agent could not. Set that next to what the successful sprees ran: Claude Code as the harness, DeepSeek v4.1 Flash as one of the engines. Cheap does not mean toy-grade. It means the expensive part of the intrusion moved into the model bill, and the sprees that worked all paid it. The moat is no longer the exploit skill. It is the model behind the loop — which is a strange sentence to write, and the numbers above are why it is the right one. Running the panel with the teeth off You can watch this architecture work on your own machine in four commands, with the offensive half disabled. Cairn ships a mock worker type that throws weighted dice instead of calling a model — same board, same loop, same protocol, zero API keys, zero network. Here is the exact configuration of my run, paste it as cairn-mock.yaml: server: "http://127.0.0.1:8000" runtime: execution: local # workers as host processes — the container default needs Docker worker_healthcheck: disabled max_workers: 2 max_running_projects: 2 max_project_workers: 2 interval: 3 healthcheck_timeout: 5 prompt_group: "mock" tasks: bootstrap: {timeout: 9, conclude_timeout: 5} reason: {timeout: 5, max_intents: 3} explore: {timeout: 9, conclude_timeout: 5} local: completed_action: keep workers: - name: "mock-observer-1" type: "mock" task_types: [reason, explore, bootstrap] max_running: 1 priority: 0 env: MOCK_HEALTHCHECK: '{"delay":[0,1],"outcomes":{"ok":1.0}}' MOCK_BOOTSTRAP: '{"delay":[1,3],"outcomes":{"complete":1.0,"fact":0.0}}' MOCK_REASON: '{"delay":[1,3],"outcomes":{"intent":0.7,"noop":0.3}}' MOCK_EXPLORE_EXECUTE: '{"delay":[1,3],"outcomes":{"fact":1.0}}' MOCK_EXPLORE_CONCLUDE: '{"delay":[1,2],"outcomes":{"fact":1.0}}' git clone https://github.com/oritera/Cairn && cd Cairn python3 -m venv .venv && .venv/bin/pip install -e ./cairn .venv/bin/cairn serve --host 127.0.0.1 --port 8000 # terminal 1 .venv/bin/cairn dispatch --config cairn-mock.yaml # terminal 2 Seed the board — note the API wants a title now, which older community runbooks do not mention: curl -s -X POST http://127.0.0.1:8000/projects -H 'Content-Type: application/json' \ -d '{"title":"mock lab","origin":"target http://10.77.0.10 (isolated lab, unreachable)","goal":"get a shell"}' The response, verbatim from my run: {"project":{"id":"proj_001","title":"mock lab","status":"active","bootstrap_enabled":true,"created_at":"2026-10-20T16:41:50Z","reason":null},"facts":[{"id":"origin","description":"target http://10.77.0.10 (isolated lab, unreachable)"},{"id":"goal","description":"get a shell"}],"intents":[],"hints":[]} Wait about forty seconds, then read the board back with one unauthenticated curl — which is, again, the entire point: {"project": {"id": "proj_001", "status": "completed"}, "facts": [ {"id": "origin", "description": "target http://10.77.0.10 (isolated lab, unreachable)"}, {"id": "goal", "description": "get a shell"}, {"id": "f001", "description": "mock fact for bootstrap"}], "intents": [ {"id": "i001", "description": "bootstrap"}, {"id": "i002", "description": "mock bootstrap complete from fact"}], "hints": []} Two practical notes from stepping on both rakes so you do not have to. The default dispatch mode runs one Docker container per project, and the published worker image has no ARM64 manifest, so on an Apple Silicon machine the default fails — execution: local in the config above is the way through. And the real intrusions Fagerland timed averaged 23 hours; mine finished in three seconds, because the stakes were dice. The speed is not the point. The shape is: same board, same loop, same protocol, and the same complete absence of a gate between the board and whoever finds the port. !blackboard The rung this sits on The authority ladder this series keeps coming back to says evidence that lives on infrastructure you do not control is a caller label. An exposed agent control plane is that failure inverted and pointed at you: your agent's findings, plans, and hints sitting on a board that describes itself to whoever connects. Last week's post was about a bypass that got logged; this one is about a door that was never installed. Both receipts come from the same place — reading what the software actually does instead of what the deployment assumes. What to steal - Audit your own control planes with one curl. From outside the network segment where an agent control plane is supposed to live, ask for GET /openapi.json. An answer means the panel describes itself, its routes, and its data model to whoever asks. Bind to loopback, or gate it behind the same VPN as everything else you would hate to lose — do not rely on the software to ship a gate. - The detection pack already exists. The Japanese defensive study ships Sigma, Falco and Datadog rules (R1–R8) mapped to MITRE ATT&CK/ATLAS and the OWASP Top 10 for LLM, built specifically for agent attack chains — recon, intrusion, orchestration. Free, and written by someone who verified their own work against live tooling. - Egress control on the workers is the real prevent layer. Gambit's report and every mitigation list in this space converge there: an agent that can only reach the destinations you allow cannot map your associated infrastructure at 3 a.m. Disclosure, because receipts series: NorForge, Fagerland's employer, sells agent egress controls, and its full report was not yet public when this post was written. The finding stands on the code; the incentives are stated so you can weigh them. - Steal the Hint primitive for your own tools. The one place a human joins Cairn's loop, the judgment lands on the board with everything else — versioned, timestamped, absorbed downstream. Dashboards show what is happening; boards record it. Two honest limits The mock proves the control plane, not the spree. My run generated facts with dice; no attack was executed against any target, full stop. The 1,200 attempted sites, the 100+ compromises, the 23-hour median and the $5,000 token bill are the researcher's estimates from observed telemetry on exposed instances — not court records — and Reuters explicitly could not determine whether data was extracted. The named companies' statements above are the other half of that uncertainty, and they belong in every retelling. My no-auth finding is a code read, not a scan. I read Cairn v0.2.1 as published on GitHub and verified the server package ships no authentication; I did not probe anyone's deployment. The release I read was the repo's state as of its last push on September 7 — three days before the September 10–15 attack window Gambit documented — which cuts both ways: it is almost certainly what ran in the field, and a repo can ship an auth layer any day now, so check the source before quoting anyone, including me. The economics table mixes two independent campaigns with different tooling and different victims; they agree on order of magnitude, not on identity, and I have kept them in separate rows for exactly that reason. Your turn Run the four commands, seed a project, and let the mock loop chew for a minute. Then post two numbers in the comments: your fact count after sixty seconds of dispatch — the dice are weighted, not scripted, so your board will not match mine, and the divergence is the loop working as designed — and the number of agent control planes on your own network that answer /openapi.json from outside their intended segment. My pair is (3 facts, 1 panel on loopback where I put it). The first number tells you what autonomous traversal looks like when nothing is at stake. The second tells you whether anything of yours is currently keeping its findings on an unlocked board.
不要吓我，现在攻击网站的难度已经到了有手就行了吗？ 一个简单提示词+Cairn这个类似/goal的通用求解引擎开源库 + deepseek-v4.1-flash, 某个人使用AI 攻击了 1000 多个电商网站，大概 10% 的成功率，平均攻破时间 23 个小时。 提示词就是图片里的内容，我也放在了评论区。 oritera/Cairn t.co
Cairn treats pentesting as state-space search. A blackboard holds Facts, Intents and Hints; agents run OODA loops and claim Intents, no direct messaging. Aimed later at vuln research and CTF. #tool #pentesting #Cairn oritera/Cairn
AIペネトレーションテストツール「Strix」を試してみた はじめに 最近、AIを使ったサイバー攻撃により日本のWebサービスでは情報漏洩事件が頻発するようになってしまいました。いちエンジニアとして大変悔しい思いですが、だからといって手をこまねいているわけにはいきません。まず、攻撃者の手口を知ることで、自分たちのアプリケーションがどこまで耐えられるのかを把握しておく必要があります。 そんな中、AIエージェントが自律的にWebアプリを攻撃し、脆弱性を発見・検証してくれるペネトレーションテストツールが増えてきました。最近の攻撃者の手法として、こうしたペネトレーションテストツールであるStrixやCairnをHermes agentのような自律エージェント基盤上で運用し、ターゲットのセキュリティホールを見つけて攻撃するという手法が取られているようです。もちろん他にも様々な攻撃手法があるとは思いますが、その一例として今回はこれらのツールのうち、Strixを実際に使ってみました。防御側としても「攻撃する側の技術」を先に使って自分のアプリを叩いておく、というのは理にかなったアプローチです。導入手順と使用感、実際の実行結果をまとめます。 検証対象には、動作確認用に自作した「あえて脆弱性を仕込んだECサイト風のRailsアプリ」を使いました。SQLインジェクションやIDOR、XSSなど、OWASP Top 10相当の脆弱性を一通り埋め込んだだけのシンプルなデモアプリです。 Strixとは Strixは「自律的なAIハッカー」のOSSのペンテストツールです。特徴は以下の通り。 マルチエージェント構成（Graph of Agents）: 偵察・攻撃・検証を担当するAIエージェントがチームで動き、発見を共有しながら攻撃面を広げていく 実際にPoCを作って検証する: 静的解析ツールのように「怪しい」で終わらせず、実際にリクエストを送って再現できるかまで確認してから報告する Dockerサンドボックス上で動作: HTTPプロキシ（Caido）、ブラウザ自動操作、シェル、Pythonの実行環境などを備えたコンテナ内でエージェントが動く LLMはLiteLLM経由で切り替え可能: OpenAI、Anthropic、Google、OpenRouterなど好きなモデルを使える CLIツールとしても、CI/CDにも組み込める: strix --target ... で単発実行、GitHub Actionsに組み込んでPRごとにスキャンすることも可能 ライセンスはApache-2.0で、開発も活発です（2026年10月時点でも頻繁に更新されている）。 インストール curl -sSL strix.ai | bash インストールスクリプトはスタンドアロンバイナリを ~/.strix/bin/strix に配置し、.zshrc（または .bashrc）にPATHを追記してくれます。 つまずきポイント: インストール直後のターミナルでは新しいPATHが反映されておらず command not found: strix になることがあります。source ~/.zshrc するか、新しいターミナルを開けば解決します。インストール自体は問題なく完了しているので、慌てずPATHを疑うのが吉です。 設定（OpenAIを使う場合） export STRIX_LLM="openai/gpt-5.1" export LLM_API_KEY="sk-...your-openai-key..." 設定は初回実行時に ~/.strix/cli-config.json に保存されるので、2回目以降は再入力不要です。 実行してみる 今回は最もシンプルな「ブラックボックス診断」、つまりソースコードや認証情報を一切渡さず、URLだけを与えて実行しました。 strix --target localhost \ --instruction "すべての発見事項とレポートは日本語で記述してください。" --instruction に日本語で指示を書くだけで、所見やレポートも日本語で出力されます。Strix自体にUI言語設定のオプションはありませんが（CLIのメニュー表示などは英語のまま）、LLMへの指示としてはこれで十分実用的でした。 実行すると、TUI（ターミナルUI）上にエージェントの階層構造がリアルタイムで表示されます。 ▼ Root Agent ├─ Web Recon Mapper ├─ Member Flow Mapper │ ├─ CSRF Validation Agent │ │ └─ CSRF Reporting Agent │ ├─ Diagnostics Validation Agent │ │ └─ Diagnostics Ping Reporting Agent │ └─ XSS Validation Agent │ └─ XSS Reporting Agent ├─ Search Input Hunter │ └─ Search Error Page Validator └─ Auth Session Validator └─ Login SQLi PoC Validator └─ Login SQLi Reporting Agent まず「Web Recon Mapper」が未認証でアクセスできる画面・エンドポイントを一通り洗い出し、そこから枝分かれする形で「会員フロー」「検索入力」「認証・セッション」といった専門エージェントが並行して深掘りしていく、という進み方でした。見つけた怪しい兆候はいったん「要追跡(needs follow-up)」として記録され、専任の検証（Validation）エージェントが実際にPoCを試し、再現できたものだけが最終レポート（Reporting）に昇格する、という2段階の仕組みになっているのが印象的でした。 実行結果 最終的に High 1件 / Medium 5件、計6件 の脆弱性が報告されました。 重要度 脆弱性 High POST /diagnostics/ping におけるOSコマンドインジェクション Medium /invoices/{id} のIDOR/BOLA（他ユーザーの注文詳細を閲覧可能） Medium 商品レビュー本文の格納型XSS Medium レビュー投稿機能のCSRF Medium POST /login のブラインドSQLインジェクション Medium 新規登録時の重複メール再登録エラーによる詳細例外露出・アカウント列挙 各所見には発見した根拠となるリクエスト／レスポンス、再現手順、推奨される対策まで日本語できちんと記述されており、そのまま社内の脆弱性管理台帳に転記できそうなレベルの品質でした。たとえばコマンドインジェクションについては「シェルを介さず、厳格な入力検証と最小権限実行を徹底する必要がある」といった具体的な改善提案も付いています。 カバレッジの自己評価も出力されており、GET /products?q= のXSS/SQLi調査やPOST /diagnostics/fetch_url（SSRF狙い）など、「調査したが問題は確認できなかった」項目も明示されていたのは地味に良いポイントでした。ブラックボックスツールにありがちな「結局どこまで見たのか分からない」という不透明さが少なかったです。 なお、気になるお値段、あと処理にかかる時間。 OSSとはいえこれを動かすためにはLLMのAPI keyが必要になり、それらは資料量に応じて料金が発生します。 今回のケースですとmodelはopenai/gpt-5.4を使用しました。 大体処理時間は30分ほどで、お値段は$19.77でした。うーん、、ちょっと高いかなぁ。。 ブラックボックスの限界も見えた 一方で、認証後の深い操作や、画面にリンクされていないエンドポイントは拾えませんでした。今回のテスト対象には他にも、新規登録フォームの隠しパラメータ経由の権限昇格（マスアサインメント）、管理画面限定の検索SQLi、どこにもリンクされていないファイルダウンロードのパストラバーサル、未リンクのJSON API経由の内部情報露出といった脆弱性を仕込んでいましたが、これらはURLだけを与えたブラックボックス診断では発見されませんでした。理由は単純で、「そこにそんな機能がある」と知らなければ辿り着けないからです。 この種の見落としは --instruction で調査観点を具体的に指示することで改善できる余地があります。たとえば「新規登録フォームで送信可能な全パラメータを試して権限昇格の可能性を調査してほしい」と明示すると、同じブラックボックスでも踏み込み方が変わってきそうです。さらに確実にやるなら、ソースコードのパスも --target に追加で渡すグレーボックス診断に切り替える方法もあります。 strix --target localhost --target ./path/to/source 副産物: ツール検証中に見つけた自分のバグ 余談ですが、Strixに/diagnostics/fetch_url（SSRFを想定したエンドポイント）を叩かせたところ、uninitialized constant DiagnosticsController::Net というエラーで落ちていることに気づきました。require "net/http" を書き忘れていたという、こちらのアプリ側の単純な実装ミスでした。AIエージェントに外部から叩いてもらったことで、自分では見逃していたエラーに気づけたのは地味に面白い発見でした。 まとめ Strixは導入が手軽で、OpenAIなど好きなLLMを繋いでDocker一発で動かせる マルチエージェントが偵察→深掘り→PoC検証という流れで動き、報告の精度・説明の質は高い --instruction を使えば日本語レポートも調査観点の指示も柔軟にできる ブラックボックス診断には限界があり、見つけてほしい観点は明示的に伝える、あるいはソースコードを渡すグレーボックス診断に切り替えるのが効果的 静的解析ツールのノイズの多さに疲れている方や、手動ペンテストの前段階として素早く当たりをつけたい方には、試す価値のあるツールだと感じました。