Cybersecurity researchers from Cisco Talos released an open-source framework on Monday to classify and analyse malware that uses artificial intelligence. They have already found proof the system works.
The tool
The framework is called Cognitive Artifact Intelligence Research Network, or CAIRN. The name refers to the stone stacks hikers place on trails to mark a path. Cisco Talos researchers used this system to identify a hacking tool with fully autonomous command-and-control infrastructure. They named the malware CLOSEDQUORUM. The software plotted its moves inside a target system by polling up to four large language models about what it should do next. It followed directives from that collective intelligence.
“The core idea is that AI integration has these vestiges, like fingerprints, that are left behind,” says Ryan Fetterman, a security researcher at Cisco Talos who led development of CAIRN. “That gives us a signal that we can use to track these samples, classify them, and look at what’s happening. What are attackers trying? What kind of emergent behaviors are we seeing? That’s a valuable resource to the defensive community as these things become more mainstream.”
What was expected versus what was found
In July 2025, the Ukrainian cybersecurity response unit CERT-UA warned about a phishing campaign using malware known as “LAMEHUG.” The implant communicated with an LLM called Qwen2.5-Coder-32B-Instruct through a Hugging Face API to get commands. “At the time I was like, ‘Wow, this is amazing. There’s gonna be this big boom of AI-enabled malware and the landscape is totally going to change,'” Fetterman says.
A year later, though, when he went to do a retrospective this summer of malware integrating AI, Fetterman was shocked that he could still only find a few documented examples. “There really wasn’t a lot there. I think I came up with maybe nine different named malware families,” and some of those were proofs of concept created for research, he says. “It just wasn’t what I was expecting, and I think I also had a hard time believing that that was the reality of where we were. So I wanted to start digging into that.”
How CAIRN works
The result is CAIRN, which is designed to flag AI-integration characteristics and attributes from metadata, and use this to classify and tag malware samples with, essentially, a unique ID. The system then analyzes each artifact in the context of everything in the CAIRN library and groups them by various traits to illustrate potential trends and connections. Fetterman says that after working on and using CAIRN for the past few months, he has discovered about 20 additional examples of AI-integrated malware.
“So while I do think this is still largely experimental for attackers, the landscape is a lot more complex and diverse than has been publicly reported,” he says. “There’s a lot going on out there, and it does provide a valuable early signal to what’s going to happen.”
The CLOSEDQUORUM malware
The CLOSEDQUORUM hacking tool that CAIRN identified is Windows malware that checks with DeepSeek, Qwen, Mistral, and Google Gemini to develop a consensus on what its next steps should be. Even if one AI service is unavailable, the malware still polls the others, creating enough redundancy that the system is totally closed and has no mechanism for human input. Cisco Talos researchers saw some links between the malware and cybercriminal forums about credit card fraud going back to 2025, and it is designed to steal login credentials and cryptocurrency. The researchers could not confirm who developed the malware, though, or whether it has actually been used in real-world attacks.
Operationalising AI
“Initially, everyone saw AI as a productivity tool, right?” says Matt Olney, senior director of threat intelligence at Cisco Talos, referring to both legitimate work and malicious hacking. “Now what we’re seeing is that it’s becoming operationalized. So for attackers, it’s allowing them to run more campaigns, hit more spaces, handle more and different computers, because they have this very intelligent box in the backend that can ask questions and give responses.”
