For years, cybersecurity practitioners have tracked different types of malware and detected potential infections using digital fingerprints to identify different hacking tools and follow their use over time. As attackers are increasingly incorporating agentic AI components into their hacking tools, researchers from Cisco Talos shared an open-source framework on Monday that they hope will be used widely to classify and analyze AI-integrated malware. They also have proof that it’s already working.
They’re calling the framework Cognitive Artifact Intelligence Research Network, or CAIRN, named after the stacks of stones that hikers set up on trails to mark the path or emphasize something about a certain spot. As malware authors expand their use of AI services, Cisco Talos researchers have used CAIRN to identify a hacking tool with fully autonomous command-and-control infrastructure. Dubbed CLOSEDQUORUM, the malware plotted its moves within a target system by polling up to four large language models (LLMs) about what it should do and taking its directives from that hive mind.
“The core idea is that AI integration has these vestiges, like fingerprints, that are left behind,” says Ryan Fetterman, a security researcher at Cisco Talos who led development of CAIRN. “That gives us a signal that we can use to track these samples, classify them, and look at what’s happening. What are attackers trying? What kind of emergent behaviors are we seeing? That’s a valuable resource to the defensive community as these things become more mainstream.”
In July 2025, the Ukrainian cybersecurity response unit CERT-UA warned about a phishing campaign it had detected using malware known as “LAMEHUG.” The implant communicated with an LLM called Qwen2.5-Coder-32B-Instruct through a Hugging Face API to get commands. “At the time I was like, ‘Wow, this is amazing. There’s gonna be this big boom of AI-enabled malware and the landscape is totally going to change,’” Fetterman says.
A year later, though, when he went to do a retrospective this summer of malware integrating AI, Fetterman was shocked that he could still only find a few documented examples. “There really wasn’t a lot there. I think I came up with maybe nine different named malware families,” and some of those were proofs of concept created for research, he says. “It just wasn’t what I was expecting, and I think I also had a hard time believing that that was the reality of where we were. So I wanted to start digging into that.”
The result is CAIRN, which is designed to flag AI-integration characteristics and attributes from metadata, and use this to classify and tag malware samples with, essentially, a unique ID. The system then analyzes each artifact in the context of everything in the CAIRN library and groups them by various traits to illustrate potential trends and connections. Fetterman says that after working on and using CAIRN for the past few months, he has discovered about 20 additional examples of AI-integrated malware.
“So while I do think this is still largely experimental for attackers, the landscape is a lot more complex and diverse than has been publicly reported,” he says. “There’s a lot going on out there, and it does provide a valuable early signal to what’s going to happen.”
The CLOSEDQUORUM hacking tool that CAIRN identified is Windows malware that checks with DeepSeek, Qwen, Mistral, and Google Gemini to develop a consensus on what its next steps should be. Even if one AI service is unavailable, the malware still polls the others, creating enough redundancy that the system is totally closed and has no mechanism for human input. Cisco Talos researchers saw some links between the malware and cybercriminal forums about credit card fraud going back to 2025, and it is designed to steal login credentials and cryptocurrency. The researchers could not confirm who developed the malware, though, or whether it has actually been used in real-world attacks.
“Initially, everyone saw AI as a productivity tool, right?” says Matt Olney, senior director of threat intelligence at Cisco Talos, referring to both legitimate work and malicious hacking. “Now what we’re seeing is that it’s becoming operationalized. So for attackers, it’s allowing them to run more campaigns, hit more spaces, handle more and different computers, because they have this very intelligent box in the backend that can ask questions and give responses.”
