For years, cybersecurity defenders have been playing a kind of forensic detective game, tracking malware the way investigators might follow footprints or tire tracks. They use digital fingerprints—unique bits of code, behavioral quirks, and telltale signatures—to identify hacking tools, attribute them to known groups, and map how they evolve over time. But the game is changing. Attackers are now beginning to weave agentic AI into their malicious creations, which means the old ways of recognizing and cataloguing malware may no longer be enough. That’s why researchers from Cisco Talos, one of the world’s most respected threat intelligence teams, have just released an open-source framework they hope will become a shared language for understanding this next generation of AI-powered malicious software. They’re calling it CAIRN, short for Cognitive Artifact Intelligence Research Network—a name deliberately borrowed from the piles of stones hikers leave on trails to mark the way or draw attention to something significant. The idea, according to Ryan Fetterman, the lead researcher on the project, is that AI-integrated malware leaves behind subtle “vestiges,” or fingerprints, that come from the very act of integrating with a model. These traces can be detected, classified, and used to track a sample’s behavior and lineage. CAIRN is designed to flag those traces from metadata and assign each sample a unique identifier, then compare it against everything else in the growing library to surface connections and trends. As a proof of concept, the team has already used CAIRN to uncover something unusual: a fully autonomous hacking tool named CLOSEDQUORUM that polls multiple large language models to decide what to do next. It’s an early, tangible sign that attackers aren’t just dabbling in AI—they’re beginning to build systems that can think on their own.
The spark for this project came from a real-world attack that Fetterman encountered in July 2025. Ukraine’s CERT-UA, the national cybersecurity response unit, had detected a phishing campaign using a malware strain called LAMEHUG. That implant was unusual because it communicated with an open-source LLM called Qwen2.5-Coder-32B-Instruct through a Hugging Face API to receive commands. When Fetterman first saw that, he remembers being genuinely dazzled. “Wow, this is amazing,” he thought. “There’s gonna be this big boom of AI-enabled malware and the landscape is totally going to change.” He expected the floodgates to open, with AI-powered attacks appearing everywhere and transforming the threat landscape overnight. But a year later, when he sat down to review the state of AI-integrated malware, he was shocked by what he found. Despite all the hype, there were only a handful of documented examples—maybe nine named families in total, and some of those were merely proofs of concept built by researchers to demonstrate what was possible, not real-world attacks. That didn’t match his expectations, and he had a hard time believing that was the actual state of things. It felt too quiet, too clean. So he decided to dig deeper. That skepticism, that refusal to accept the apparent calm, is what led to CAIRN. Fetterman wanted to build a tool that could look beyond the obvious, to find the hidden traces that most analysts might miss—the small clues that reveal whether a piece of malware has consulted an AI model, which model it used, how often, for what purpose, and what the implications might be.
So how does CAIRN actually work? Think of it as a reference library and a fingerprint scanner rolled into one. It takes a malware sample, examines its metadata for signs of AI integration—things like API endpoints that connect to language model services, unusual communication patterns, or embedded instructions that read like prompts—and tags those characteristics. It then assigns the sample a unique identifier, essentially a classification seed, and places it into the broader CAIRN library. From there, the system analyzes the sample in context, grouping it with others that share similar traits and highlighting potential trends, relationships, and emergent behaviors. It’s not just about identifying which AI a piece of malware is talking to; it’s about understanding how attackers are using these models, what they’re trying to achieve, and how those practices might evolve. Fetterman has been using CAIRN internally for only a few months, and already he’s identified around twenty additional examples of AI-integrated malware that had not been publicly documented. That’s a significant find, especially when compared to the nine families he could find in open reporting over the previous year. It suggests the real picture is far richer and more complicated than anyone had realized. “There’s a lot going on out there,” he says. While AI-enabled malware is still largely experimental, the early signal is that the threat landscape is more diverse, more active, and more creative than public reporting indicates. Attackers are experimenting, iterating, and pushing boundaries in ways that are often invisible to outside observers. CAIRN offers a way to pull back the curtain and see what’s really happening.
Perhaps the most striking discovery to come out of CAIRN so far is CLOSEDQUORUM, a piece of Windows malware that represents a genuine leap in autonomous hacking. Rather than simply following a preprogrammed list of commands, CLOSEDQUORUM checks in with no fewer than four different large language models—DeepSeek, Qwen, Mistral, and Google Gemini—and uses their collective responses to determine its next move. It treats the group of models like a kind of hive mind, polling each one for advice and then acting based on the consensus. Even if one of the AI services is unavailable or refuses to respond, the malware simply polls the others, building in enough redundancy that the system remains fully operational as long as at least one model is reachable. What’s particularly striking is that the entire system is closed and autonomous: there is no mechanism for human input, no kill switch, no operator waiting in the wings to override a decision. The malware’s commands are generated entirely by the AI models themselves. The researchers at Cisco Talos saw possible connections between CLOSEDQUORUM and cybercriminal forums focused on credit card fraud, with activity dating back to 2025. The malware itself is designed to steal login credentials and cryptocurrency from infected machines, making it a practical tool for financial crime rather than a mere experiment. That said, the team could not confirm who built it or whether it has been deployed in real-world attacks. Still, its existence is a powerful demonstration of where things are headed. Instead of relying on a static command-and-control server, an attacker could simply release this kind of malware and let it think for itself, adapting to whatever environment it finds itself in.
The broader implication, as Cisco Talos senior director Matt Olney points out, is that AI is shifting from being a productivity tool to something far more operational. In the early days, everyone—legitimate workers and cybercriminals alike—saw AI as a way to do things faster: write emails, draft code, summarize documents, that kind of assistance. But now, attackers are beginning to treat AI as an actual operator, a brain behind their operations that can run campaigns at scale, manage multiple computers simultaneously, and make decisions in real time. Olney describes it as a “very intelligent box in the backend” that can answer questions, give responses, and effectively run the show. That changes the calculus for defenders. When a human operator has to be involved, there are limits based on human attention, time, and endurance. An attacker can’t be everywhere at once. But an AI-driven malware system has no such constraints. It can handle more and different computers, adapt to defenses, and keep going around the clock. It’s a force multiplier in the truest sense. For the defensive community, that means the old ways of tracking and responding to attacks need to evolve too. That’s why Fetterman and his colleagues are releasing CAIRN as an open-source framework. They want it to be adopted and built upon by other security teams, academic researchers, and anyone else who has a stake in understanding AI-powered threats. The more people who use it, the more data the community can gather, and the better everyone becomes at spotting these emerging patterns before they become widespread.
In the end, CAIRN is more than just a piece of software—it’s a philosophy about how to approach a changing threat landscape. The cairns for which it’s named are markers left on hiking trails to guide those who come after, to show them the path and draw attention to important spots. In the world of cybersecurity, those markers are now being left behind by AI-integrated malware, whether intentionally or not. It’s up to defenders to spot them, understand them, and share what they learn. Fetterman’s journey from excitement to skepticism to discovery is a reminder that progress doesn’t always look the way we expect. The boom he anticipated did happen, but it happened quietly, in shadows, beneath the surface of public reporting. Without tools like CAIRN, those hidden developments might remain invisible until they emerge all at once, catching us off guard. The fact that a single framework has already surfaced more than twenty undocumented AI-integrated malware samples suggests there is much more to find. The future of cybercrime is likely to be shaped by autonomous systems that can think, learn, and adapt on their own—and with them, the future of cybersecurity defense will need to be equally adaptive. By sharing CAIRN with the world, Cisco Talos is effectively asking the entire community to become hikers on the same trail, passing along the markers they find and adding their own observations along the way. It’s a call to collaborative vigilance in an era where the machines on both sides are growing smarter. For now, no one knows exactly where that path will lead, but with tools like CAIRN in hand, defenders have a much better chance of reading the signs before it’s too late.
