Cisco Talos Open-Sources CAIRN to Hunt AI-Integrated Malware

Cisco Talos on September 22, 2026 released CAIRN (Cognitive Artifact Intelligence Research Network), an open-source research toolkit for hunting, classifying, and tracking emerging AI-integrated malware. The accompanying findings series opens with CLOSEDQUORUM, which Talos described as, to its knowledge, the first publicly documented Windows implant to delegate tactical command-and-control (C2) decisions to a panel of commercial large language models (LLMs).

The toolkit was detailed in a Talos blog post authored by Ryan Fetterman. Talos defines AI-integrated malware as malware that functionally operationalizes, explicitly targets, or exploits AI systems and their ecosystems, spanning functional integration into attack chains, credential and infrastructure compromise, and ecosystem-level abuse. The methodology treats the traces that integration leaves inside attacker tooling, such as prompt templates, provider endpoints, API keys, and jailbreak terms, as…