Cisco Talos Releases CAIRN to Track AI-Enabled Malware and Discovers Autonomous Hive Mind Threat

For AI builders and security teams building AI-powered products, the emergence of malware that operates autonomously by polling multiple large language models is a significant shift. Cisco Talos researchers released CAIRN, an open-source framework designed to classify and analyze AI-integrated malware by extracting persistent fingerprints. Using CAIRN, they identified a new Windows malware called CLOSEDQUORUM that queries four LLMs to decide its next steps with no human intervention.

CAIRN: Fingerprinting AI Integration in Malware

CAIRN, which stands for Cognitive Artifact Intelligence Research Network, tags malware artifacts with unique IDs and contextual metadata. The framework then groups samples by traits to reveal trends, use-cases, and potential operator links. According to Ryan Fetterman, the lead researcher, "AI integration has these vestiges, like fingerprints, that are left behind." This allows defenders to track samples and observe emergent behaviors as attackers experiment with AI-driven tools. After months of retroactive analysis, CAIRN helped discover about 20 additional examples of AI-integrated malware, indicating the landscape is more complex than previously reported.

CLOSEDQUORUM: Autonomous Hive Mind Malware

The most striking discovery was CLOSEDQUORUM, a Windows malware that polls DeepSeek, Qwen2.5-Coder-32B-Instruct, Mistral, and Google Gemini to reach a consensus on what actions to take next. Even if one AI service is unavailable, the malware continues to operate using the others, creating a closed loop with no mechanism for human input. The malware is designed to steal login credentials and cryptocurrency, and researchers found links to cybercriminal forums discussing credit card fraud dating back to 2025, though they could not confirm real-world deployment or attribution.

This is a departure from earlier AI-assisted malware like LAMEHUG, which was spotted in a CERT-UA phishing campaign in mid-2025 and used a single LLM via Hugging Face API. CLOSEDQUORUM represents a more robust, fault-tolerant approach.

Why This Matters for AI Builders and Defenders

For product teams building AI or agentic systems, the same capabilities that enable automation can be weaponized. The shift from AI as a productivity tool to an operational component of malware, as described by Cisco Talos' Matt Olney, means defenders need new detection methods. Traditional signature-based approaches won't catch AI-enabled malware that dynamically decides its behavior. CAIRN provides a classification framework that can serve as an early warning system.

Builders should pay attention to the LLM polling pattern: malware that uses multiple models for consensus is harder to disrupt. If you are running AI services or APIs, consider rate limiting and anomaly detection for unusual query patterns that could indicate malicious use.

Caveats and Limitations

The research is based on a single investigative article, and details may evolve as CAIRN is applied more broadly. Cisco Talos could not confirm whether CLOSEDQUORUM has been deployed in actual attacks, and attribution remains unconfirmed. Additionally, the 20 additional samples found by CAIRN may include proof-of-concept malware, so the operational threat level may still be low. However, the framework offers a valuable early signal for the defensive community.