Cairn AI pentest trial: prompt wording drives depth to 18 facts, 18 intents

The trial follows an earlier piece on Strix, and the author frames the two tools as complementary rather than competing. Strix is a fixed multi-agent setup where reconnaissance, attack, and verification agents work as a team, while Cairn builds a graph from just Facts, Intents, and human-injected Hints, with no fixed worker roles and coordination only through that shared blackboard. That design is why, as a worker read source code reached via path traversal, it split its own next hypotheses — command injection, SSRF, SQLi — into separate Intents and worked through them in order, much as a human pentester would.

The run-by-run contrast is the heart of the piece. A first run with a plain origin and goal surfaced IDOR, a path traversal that captured master.key, app source, and the SQLite DB, and a mass-assignment admin escalation, but all Facts were in English. A second run with a Japanese instruction in the prompt produced Japanese output and an SSRF evaluation based on response differences, yet wrote no Markdown file at all, unlike the first run — the author concludes that whether a file is produced is up to the worker and non-deterministic. A third run, with the goal rewritten to specify the report path and broader scope, completed 18 Facts and 18 Intents and generated report.md reliably.

Operationally, the author sees the local-mode subscription reuse as Cairn's clear advantage over Strix, while noting that the missing sandbox moves the burden of isolation to the user. The four most severe findings in the final report — mass assignment, OS command injection at root, cookie forgery via secret_key_base, and UNION-based SQL injection — are presented as evidence that writing the goal carefully is what unlocks depth, and the author argues defenders should run the same class of tools against their own apps.