Cisco Talos releases CAIRN, an open toolkit for hunting AI-integrated malware, and finds a Windows sample that polls four LLMs for its next move: Reveneau

Why it mattersA defender's hunting layer that reads AI vestiges in metadata means teams can now search a malware corpus for prompt strings and provider endpoints, without holding the binary.

An unnamed Windows binary in the wild was found asking DeepSeek, Qwen, Mistral, and Google Gemini what it should do next. Cisco Talos published CAIRN, the Cognitive Artifact Intelligence Research Network, on 22 September 2026, and describes it as a metadata-first research toolkit for hunting, classifying, and tracking AI-integrated malware. The first sample Cisco Talos ships with the release is called CLOSEDQUORUM.

How CAIRN reads a sample without touching the binary

The blog by Ryan Fetterman, on the Talos Intelligence site, says CAIRN works entirely from file metadata. It runs up to 24 acquisition filters against the VirusTotal metadata surface: extracted strings, sandbox behaviour, and antivirus detection labels. Named filters include provider-api-integration, which looks for LLM endpoint domains such as api.openai.com, api.anthropic.com, api.deepseek.com, and generativelanguage.googleapis.com; python-ai-scripts, which matches AI framework import patterns for langchain, litellm, and openai; ai-analysis-evasion, which searches for strings written to instruct an LLM sandbox to ignore a file; local-llm-runtime, which surfaces ollama, llama.cpp, vllm, gguf, and safetensors; and agentic-tooling, which looks for tool_call and tool_calls syntax co-occurring with offensive capability terms.

The three-tier ontology and what YARA is allowed to see

CAIRN stores hits in a SQLite corpus, runs YARA on import, and uses a three-tier classification. Tier 1 records primitive AI artifacts, such as API endpoints and tool-call syntax. Tier 2 adds behavioural context, such as AI-analysis evasion combined with a known command-and-control method. Tier 3 attributes a sample to a named operational family. Talos writes that Tier 3 rules face a specific constraint: the sharpest reverse-engineering signals cannot be hunted on, because they are only present in the binary. A CAIRN rule must fire on what VirusTotal exposes as metadata, so the discipline is to pin down the family by reverse engineering and then find a string- or metadata-accessible trait that travels with the mechanism. A cairn rescan reapplies all three tiers offline, so a new Tier 3 rule surfaces older samples retroactively.

What CLOSEDQUORUM does, and what Talos would not say

The Wired report by Lily Hay Newman, dated 22 September 2026, adds context around the release. Talos researcher Ryan Fetterman told Wired that a July 2025 CERT-UA warning on the LAMEHUG implant, which took commands from Qwen2.5-Coder-32B-Instruct through a Hugging Face API, made him expect a wave of AI-integrated malware. When he looked again in the summer, he could name only about nine families. After a few months with CAIRN, Fetterman says, he had discovered roughly 20 additional AI-integrated malware examples. CLOSEDQUORUM is the first Talos ships publicly: a Windows binary that polls DeepSeek, Qwen, Mistral, and Google Gemini and takes a consensus decision on its next step, with enough redundancy that the loss of any one provider does not stop it. Talos says the malware shows links back to cybercriminal forums discussing credit card fraud from 2025, and appears designed to steal credentials and cryptocurrency. Fetterman told Wired that Talos could not confirm who wrote it, or whether it has been used in a real attack.

The read for a security team is that the AI vestiges in a compromised binary are now a hunting surface in their own right, and the toolkit that reads them is on Talos' blog and shared for defenders to run. The bar to catch a family shifted the moment API keys, provider endpoints, and prompt templates started travelling with the payload. Whether a team runs CAIRN or writes its own filter, the artifacts CAIRN names are the ones that survive the trip from the disassembly bench to the metadata surface, which is where a defender who does not have the binary can still see them.

Source

This item was written by an AI system from the linked source. Reveneau is responsible for what it publishes.