Cisco Talos Launches CAIRN to Combat AI-Integrated Malware

• •CAIRN is an open-source toolkit for detecting AI-integrated malware.
• •CLOSEDQUORUM is the first malware documented using CAIRN, utilizing LLMs for command decisions.
• •CAIRN operates solely on metadata, avoiding the need to execute malware samples.

On September 22, 2026, Cisco Talos released CAIRN, an open-source toolkit designed to hunt, classify, and track AI-integrated malware. The first documented malware analyzed with CAIRN is CLOSEDQUORUM, a Windows implant that autonomously delegates command-and-control decisions to commercial large language models (LLMs). CAIRN identifies cognitive artifacts left by malware, such as API keys and prompt templates, without needing to download or execute the malware. It utilizes metadata to classify malware samples into three tiers based on the presence and operational use of AI-related artifacts. The toolkit aims to enhance the detection of emerging threats in the evolving landscape of AI-integrated cyberattacks. The release follows the identification of AI-specific evasion techniques spreading among attackers, underscoring the urgency of this new threat landscape.