Cisco Talos researchers have released an open-source framework for identifying malware that incorporates AI, and they say it has already exposed a hacking tool with no human command channel. The framework, called the Cognitive Artifact Intelligence Research Network, or CAIRN, looks for technical traces left when malicious software connects to models and AI services.
Its most striking finding is CLOSEDQUORUM, Windows malware that polls four large language models to decide what to do inside a compromised system. The tool seeks a consensus from DeepSeek, Qwen, Mistral and Google Gemini, creating redundancy if one service becomes unavailable.
AI Integration Leaves New Malware Fingerprints
Traditional threat intelligence often follows digital fingerprints that identify malware families and connect campaigns over time. CAIRN applies the same principle to characteristics associated with AI integration.
The system extracts relevant attributes from metadata, assigns artifacts an identifying profile and compares each sample with the rest of its library. Cisco Talos security researcher Ryan Fetterman said those traces can reveal what attackers are attempting and help defenders study emerging behavior before AI-enabled malware becomes routine.
The project grew from a gap between expectations and documented evidence. Ukraine’s CERT-UA warned in July 2025 about LAMEHUG, malware that obtained commands from the Qwen2.5-Coder-32B-Instruct model through a Hugging Face interface. Fetterman expected a rapid expansion after that case.
A retrospective conducted about a year later found only around nine named AI-integrated malware families, including research proofs of concept. After building and using CAIRN for several months, Fetterman said the team found roughly 20 additional examples.
Those counts indicate a more varied landscape than public reporting had captured, but the researcher still described attacker use as largely experimental.
CLOSEDQUORUM Removes the Human Operator
CLOSEDQUORUM uses multiple models as a closed command-and-control system. It asks them to determine its next move, continues operating if one provider is unreachable and contains no mechanism for human instructions.
The malware is designed to steal login credentials and cryptocurrency. Talos researchers found links to cybercriminal discussions about credit-card fraud dating to 2025, but they could not determine who created the tool or confirm that it has been deployed in real attacks.
That limitation is important. CLOSEDQUORUM demonstrates an autonomous architecture in a discovered sample; it does not prove that large numbers of victims have faced a four-model malware campaign. The research establishes capability and intent signals, not measured prevalence.
Its redundancy nevertheless changes the defensive problem. Blocking a single model service may not stop a malicious program that can consult three alternatives. Decision-making is also moved into external AI systems rather than a conventional command server controlled moment by moment by an attacker.
An Open Framework Builds Early Warning
Cisco Talos wants CAIRN to become a shared method for classifying and analyzing this new category. A common framework could let researchers compare samples, spot recurring implementation patterns and separate genuine operational tools from experiments.
Matt Olney, the company’s senior director of threat intelligence, said AI is moving from a productivity aid into an operational component for attackers. In that role, it could help campaigns reach more systems and handle varied environments through a decision-making layer in the background.
CAIRN does not show that autonomous malware has displaced conventional hacking. Its value is earlier visibility: the framework can collect evidence while the category is still small and definitions remain unsettled.
The discovery of CLOSEDQUORUM gives defenders a concrete case around which to build that taxonomy. Its four-model design is technically notable, but the unresolved author, deployment history and victim count keep the threat assessment grounded. The system is a warning about where malicious automation may be heading, not proof that it has already arrived at scale.
