Cisco Talos released an open-source framework on September 22, 2026 for classifying AI-integrated malware, and the first thing it turned up was a Windows implant that runs its command-and-control loop by polling four large language models and acting on the consensus. The framework, called CAIRN — Cognitive Artifact Intelligence Research Network — fingerprints the metadata traces that AI-integration leaves behind in malware samples, then groups them to expose trends. The malware Talos identified with it, dubbed CLOSEDQUORUM, has no human operator in the loop at all.
CLOSEDQUORUM queries DeepSeek, Qwen, Mistral, and Google Gemini in sequence to decide its next move on an infected machine. If one service is unreachable, it falls through to the others, meaning the system is fully closed and self-directing. Talos tied the sample to cybercriminal forums discussing credit card fraud going back to 2025, and its payload is built to steal login credentials and cryptocurrency, though researchers could not confirm who wrote it or whether it has been used in a live campaign.
The premise behind CAIRN is that calling out to an LLM is not free — it leaves observable artifacts in code, network traffic, and behavior. Ryan Fetterman, the Cisco Talos security researcher who led CAIRN's development, describes those artifacts as fingerprints defenders can catalog the same way they catalog any other malware family trait.
Key facts
- 01Cisco Talos open-sourced CAIRN on September 22, 2026, a framework for fingerprinting AI-integrated malware from its metadata traces.
- 02CAIRN surfaced CLOSEDQUORUM, Windows malware that polls up to four LLMs — DeepSeek, Qwen, Mistral, and Google Gemini — for its next command.
- 03Researcher Ryan Fetterman found only 9 named AI-integrated malware families in a mid-2026 retrospective, then uncovered roughly 20 more using CAIRN.
- 04CLOSEDQUORUM has no human command channel — if one model is unavailable, it queries the others and acts on the consensus.
- 05Talos linked CLOSEDQUORUM to 2025 credit-card fraud forums; the malware targets login credentials and cryptocurrency wallets.
The project started as a retrospective. In July 2025, Ukraine's CERT-UA published a warning about a phishing campaign using malware known as LAMEHUG, which pulled its commands from Qwen2.5-Coder-32B-Instruct through a Hugging Face API. Fetterman expected LAMEHUG to be the front edge of a wave. When he went looking a year later in summer 2026, he could document only about nine named AI-integrated malware families, several of them research proofs of concept rather than deployed threats.
That gap between the expected boom and the visible reality is what motivated CAIRN. Rather than count only what had been publicly named, Fetterman built a system to hunt for the fingerprints directly. Using CAIRN over the past few months, he has surfaced roughly 20 additional examples of AI-integrated malware beyond the nine documented families — a threefold expansion of the known set.
CLOSEDQUORUM is the most structurally striking of those finds. Most AI-enabled malware to date has used a single model as a helper: generating obfuscated code, drafting phishing lures, or answering a specific question. CLOSEDQUORUM treats the models as a decision-making committee, which both increases resilience against any one provider blocking the traffic and eliminates the operator-side infrastructure that defenders have historically used to disrupt botnets.
“So while I do think this is still largely experimental for attackers, the landscape is a lot more complex and diverse than has been publicly reported.”— Ryan Fetterman, Security researcher at Cisco Talos
The four-model architecture is also a hedge against provider-side safety measures. If DeepSeek or Gemini refuses a prompt or rate-limits a suspicious pattern, the malware still gets a usable answer from Qwen or Mistral. For defenders, that means shutting down a single API key or provider relationship no longer takes the operation offline — a meaningful shift in the takedown playbook.
Matt Olney, senior director of threat intelligence at Cisco Talos, frames the broader trend as attackers moving past AI-as-productivity into AI-as-operator.
Talos is releasing CAIRN as open source so other researchers can extend the library and contribute samples. The company has not published detection signatures for CLOSEDQUORUM specifically, and the malware's real-world footprint remains unclear — Fetterman is candid that AI-integrated malware is still largely experimental among attackers, and that the counted samples number in the low dozens rather than the thousands.
The unknowns cut both ways. Talos could not verify authorship of CLOSEDQUORUM or whether victims have been hit, and treating a handful of samples as a trendline is exactly the kind of extrapolation that produced the overheated 2025 forecasts CAIRN was built to correct. A framework that measures fingerprints is only as useful as the sample pool it draws from, and that pool is still small.
The interesting shift for the AI security market is not the malware count — it is that defenders now have a categorization primitive built specifically for LLM-integrated tooling, released before the wave rather than after it. If CAIRN gets adoption across other threat-intel teams, the industry will finally have shared vocabulary for AI-enabled samples, which is the precondition for shared detections. The bigger question CLOSEDQUORUM raises is commercial: whether frontier model providers treat autonomous malware polling their APIs as an abuse problem worth engineering against, or as traffic they cannot practically distinguish from a developer building an agent.
Working on something we should cover, or seeing a story we missed? Send leads, documents, or feedback to hello@aichatdaily.com. For sensitive tips, see our secure tips page for Signal and PGP options.
Spotted an error? Email hello@aichatdaily.com with the URL and the issue, or read our full corrections policy.
