A New Tool for Tracking AI Malware Uncovers Malware That Operates Without Human Control

Cisco Talos has released CAIRN, an open-source toolkit designed to hunt, classify, and track AI-integrated malware by examining the digital markers developers leave behind.

The Cognitive Artifact Intelligence Research Network searches for prompt templates, provider endpoints, API-key prefixes, jailbreak terms, and orchestration logic without downloading or executing binaries.

The launch also revealed CLOSEDQUORUM, which Talos describes as the first publicly documented Windows implant to delegate tactical command-and-control decisions to artificial intelligence.

Instead of awaiting instructions from a human operator or dedicated C2 server, the malware consults up to four commercial large language models—DeepSeek, Qwen, Mistral, and Google Gemini and uses plurality voting to choose its next action. Talos has not confirmed real-world deployment, and the public build is nonfunctional.

Static analysis nevertheless exposed a complete autonomous decision loop. CLOSEDQUORUM gathers system details, inserts that context into structured prompts, and asks each model to select constrained actions such as stealing data, establishing persistence, or injecting code.

The winning response can trigger LSASS memory dumping, browser-password collection, cryptocurrency-wallet theft, process hollowing, APC injection, or Windows persistence mechanisms. It can send encrypted stolen data through Discord and continue without live tasking.

CAIRN Tool for Tracking AI Malware

According to technical analysis published by Cisco Talos, CAIRN was built to find this emerging threat class at scale. It applies up to 24 acquisition filters to metadata from extracted strings, antivirus labels, and sandbox behavior.

Filters seek domains such as api.openai.com and api.anthropic.com, Python libraries including LangChain and LiteLLM, local inference components such as Ollama and llama.cpp, and agent-style tool-call syntax alongside offensive terminology. Candidates enter a SQLite corpus for automatic YARA scanning.

The toolkit organizes detections into three levels. Tier 1 identifies primitive AI artifacts, including endpoints or function-calling syntax. Tier 2 adds behavioral context by linking artifacts with activity such as AI-analysis evasion or known C2 methods.

Tier 3 attributes samples to confirmed malware families using fingerprints validated through reverse engineering. Updated rules can rescan the local corpus and retroactively identify older samples.

CAIRN also combines relationship graphs with semantic discovery. Its explorer connects samples through shared domains, certificates, import hashes, submitters, and AI providers, revealing variants and campaign infrastructure.

For less obvious links, CAIRN builds metadata documents from antivirus names, URLs, PE resources, and sandbox observations, then uses embeddings, HDBSCAN, and UMAP to expose similar samples and outliers. Talos stresses that clusters generate leads, not attribution.

That warning matters because AI-related strings increasingly appear in legitimate software. PyInstaller packages may expose an entire development environment, while Tauri and Go binaries can create structural matches that generate noisy Tier 1 or Tier 2 results. CAIRN therefore narrows large collections before reverse engineering rather than replacing it.

The findings signal a shift toward autonomous attack orchestration. LAMEHUG used Alibaba’s Qwen model through Hugging Face to generate commands during attacks reported in 2025, but CLOSEDQUORUM goes further by assigning a bounded C2 phase to a model panel. Blocking AI domains alone is impractical because legitimate applications use the same services.

Defenders should instead correlate unexpected multi-provider traffic with LSASS access, process injection, persistence changes, and Discord communications.

Although CLOSEDQUORUM is not a proven campaign, CAIRN offers defenders a practical framework for tracking machine-directed malware. That visibility could become increasingly important as attackers automate more of the intrusion lifecycle.

Cut every SOC alert investigation by 21 min. Power your SOC with instant IOC context for immediate response: Integrate TI Lookup in your SOC