Cisco Talos open-sources CAIRN to hunt AI-integrated malware

Cisco Talos released CAIRN (Cognitive Artifact Intelligence Research Network), an open research toolkit that hunts and classifies AI-integrated malware from metadata such as prompt templates and LLM provider endpoints, and began publishing findings with CLOSEDQUORUM.

SOFTWARE desk — defenders finally get a shared way to fingerprint malware that calls OpenAI and Anthropic the same way ordinary apps do.

Why the name. Talos says a cairn is a stack of stones hikers leave on a trail so the next person can find the path. Attackers who build malware around AI, Talos says, leave markers too, often without meaning to: prompt templates, provider endpoints, API keys, jailbreak terms, and other text baked into the tools. A prompt template is the written instruction the program sends to a model. A provider endpoint is the web address of a model company. An API key is the secret the software uses to call that service. A jailbreak term is phrasing meant to push a model past its own rules. Talos calls these strings cognitive artifacts, leftovers from bolting AI into the program. The method pulls those strings out, relates them, and sorts them without ever touching the underlying binary. A binary is the program file itself. Metadata is the text and labels already attached to a file. Metadata-first means the hunt reads that text. It does not download the program, and it does not run it.

Where the code lives. On the post, the name CAIRN links to github.com/Cisco-Talos/Cognitive-Artifact-Intelligence-Research-Network. Later, the phrase “open-sourcing CAIRN” links to github.com/Cisco-Talos/CAIRN. This desk requested that short address and was redirected to the longer repository name. Open-sourcing, in Talos’s sentence, means the code is public so other researchers can read it and improve it. Talos says it hopes the community will refine the filters, the rules, and the way findings are written up. This desk did not review the license or audit the repository.

How a hunt starts. Talos says CAIRN finds candidate samples through up to 24 acquisition filters. A filter, here, is a saved search for one kind of clue. The post says those filters search metadata, including strings pulled from the file, what a sandbox recorded, and antivirus detection labels. A sandbox is a safe machine that runs a suspicious file and writes down what it does. An antivirus label is the name a security product sticks on a file. Talos prints examples. It does not print a list of all 24, and this desk did not count them. One filter, provider-api-integration, looks for model-provider addresses. The examples on the page are api.openai.com, api.anthropic.com, api.deepseek.com, and Generativelanguage.googleapis.com, printed with that capital G. Another, python-ai-scripts, looks for Python files whose import lines match AI frameworks. An import is a line that pulls in a library. The examples are langchain, litellm, and openai. LangChain and LiteLLM are toolkits programmers use to call models from code. Another, local-llm-runtime, looks for signs of a model running on the machine itself, with examples ollama, llama.cpp, vllm, gguf, and safetensors. Another, ai-analysis-evasion, looks for text aimed at an AI reviewer, the kind of comment that tells an automated sandbox there is nothing to see. Another, agentic-tooling, looks for tool-call syntax, the phrasing a model uses when it asks software to take an action, sitting next to offensive terms. The examples are tool_call, tool_calls, and function_call. File those names as the post’s examples.

What happens to a hit. Talos says the results go into a SQLite corpus, and YARA runs automatically when a sample is imported. SQLite is a small database stored as one file. A corpus is the collection. YARA is a pattern language defenders use to match known text. The rules sit in a three-layer ontology, which is just a set of categories with a rank. Tier 1, T1, is primitive AI artifacts. An API address or tool-calling syntax is present. That tier says AI-related text is there. It does not say the program is an attack. Tier 2, T2, is behavioral context. Combinations suggest the AI is being used for real, for example text meant to dodge an AI reviewer, or a known command-and-control method. Command and control, shortened to C2, is how malware gets its orders. Tier 3, T3, is named operational families. A family is a group of samples that belong to one known malware. A T3 rule is a confirmed fingerprint for that family.

The explorer, and the limit on a cluster. Talos says CAIRN has an explorer that draws a graph of how those artifacts connect, so a defender can look for related families, shared infrastructure, and the people behind them. A graph, here, is a map of links. The same screen can show a UMAP view. UMAP is a way to place samples with similar metadata near each other on a flat map. Talos says that view is an unsupervised pass over the corpus using HDBSCAN and UMAP. Unsupervised means the computer groups samples without a person first naming the groups. HDBSCAN is the grouping method. Talos is plain about the limit: sharing a cluster is a weak hint that two samples look alike, not a strong claim that they are the same family. A cluster is a lead. Every interesting group still needs a person to check that the AI angle is real and not a false neighbor. This desk did not open the explorer.

Four ways Talos says an analyst uses the toolkit, in short. One: the filters grow the collection with samples you have not seen. Two: once a sample matters, you follow the graph to related malware, shared domains and addresses, and other pieces of a campaign. Three: YARA scores the metadata text in the three tiers. Talos says an ordinary YARA rule is written after someone takes a program apart, and the sharpest clues often exist only if you hold the file. A CAIRN rule has to match what VirusTotal already shows as metadata: readable strings, import names, version fields, and certificate names. VirusTotal is a service where people upload files and the site shows text pulled out of them. The clue has to survive that trip, from the inside of the file up to the surface, without a download. Four: semantic discovery. Semantic means “about the same idea,” even when the exact words differ. Talos says YARA finds what you already know to search for. A numeric summary of the text, called an embedding, can flag samples that read as similar even with no shared sentence. Talos treats that map as a complement to YARA, not a replacement. The text that feeds it, on the post, includes antivirus labels, web addresses, short snippets of matched file content, resource strings such as a company name, and behavior strings from a sandbox. This filing is not a manual for those steps.

What the first hunts suggest, as Talos writes it on the CAIRN post. The hunts have looked at active malware development since July 2025, when Talos says the first AI-integrated samples were reported in the wild, naming LAMEHUG and CERT-UA. CERT-UA is Ukraine’s computer-emergency response team. Four observations are on the page. One: an autonomy escalation arc. Autonomy means the software picks the next step. Talos says the path from “LLM as an optional feature” to a “fully autonomous multi-model consensus orchestrator with no human operator” filled in within a single calendar year. Consensus means several models agree. An orchestrator is the piece that asks them and then acts. Two: Talos says a trick for dodging AI analysis, natural-language text telling an LLM sandbox to look away, was traced to a named red-team instructor and later showed up in samples from actors with no link to that course, within 12 months of its first confirmed use in the wild, and has moved from scripts into compiled programs. A red team is a group paid to attack systems so defenders can practice. The post says the instructor is named. This desk does not add a name that sentence does not print. Three: the “no free lunch” caveat. T1 and T2 hits without real AI use are common. Talos’s examples: packing a Python app into one file can expose the developer’s whole set of installed libraries as visible strings even when the app does not use those libraries; Tauri apps and some Go program structures collect detection labels from their shape alone. The packaging name stays in Sources. Analysts should expect that noise. Four: Talos says the window for watching the transition may be short, because AI strings are becoming normal in ordinary software. Filters will have to move from “an AI string is present” toward “why it is there.” Final calls, Talos says, still need reverse engineering, a person taking the program apart. File all four as Talos’s observations. This desk did not count the samples.

CLOSEDQUORUM is the first findings post, and it has a hard limit. The CAIRN post says Talos will share what it found over time, starting the same day with CLOSEDQUORUM. The companion is “The Closed Quorum: Inside the first reported autonomous AI C2 implant,” also by Ryan Fetterman, stamped Tuesday, September 22, 2026 06:00. Its published-time metadata is 2026-09-22T10:00:58.000Z, also 6:00 a.m. Eastern. Talos says CLOSEDQUORUM is a malware file found through CAIRN, and that it shows fully autonomous command and control. After it is on a machine, Talos says, it hands the choice of its next action to a panel of commercial models, up to four: DeepSeek, Qwen, Mistral, and Google Gemini, and then carries out that choice. The aim, in Talos’s words, is harvesting user credentials and crypto wallets. Talos says it does not have confirmation the file was used in the wild. It says a close reading of the file confirms the decision loop, that development builds show keys can be inserted when the program is compiled, and that the public build contains placeholder API keys and a dummy webhook, so Talos did not watch a full run. A webhook is an address a program can post a message to. Talos also says artifacts in the file were used to connect the developer to criminal-forum posts about carding, meaning credit-card fraud, going back to 2025. Those sentences are Talos’s. This filing does not copy the implant’s prompts, its vote-counting routine, or its list of theft and injection steps. Those stay on the companion page.

What CAIRN is not. Talos says it is too soon to know whether AI-integrated malware stays an experiment or becomes a new way attacks are run. It says adversaries are putting LLMs into the tools they use on operations, and that researchers need methods that scale past taking each file apart by hand. Metadata-first hunting is a complement to that work. The line to keep is Talos’s own: “CAIRN is a research effort, not a pure active threat signal.” A threat feed would be a live list of attacks to block right now. This release is a research toolkit, plus a place to publish what the hunts find. Do not read an open-source launch as a claim that every T1 hit is a live intrusion.

Plain English for the rest of the card: CAIRN = Cognitive Artifact Intelligence Research Network, Talos’s open research toolkit. LLM = a text model. metadata = text and labels already attached to a file, not the program running. cognitive artifact = a leftover of AI use, such as a prompt, a provider address, a key prefix, a jailbreak phrase, or tool-call syntax. binary = the program file. SQLite = a database in one file. YARA = rules that match known text. T1 = AI-related text is present. T2 = the combination looks like operational use. T3 = a named malware family. C2 = how malware gets orders. UMAP = a flat map of which samples look alike. A cluster on that map is a lead, not a verdict. VirusTotal = a site that shows text pulled from uploaded files. CLOSEDQUORUM = the first sample Talos wrote up from this project, a Windows implant that asks up to four commercial models what to do next. Talos has not confirmed it was used in the wild. up to 24 = the ceiling Talos puts on its acquisition filters, not a count this desk made. This filing is the 22 Sep toolkit announcement.

PRIMARY here: Cisco Talos’s 22 Sep 2026 post, “Introducing CAIRN: Frontier tracking for AI-integrated malware,” by Ryan Fetterman, at blog.talosintelligence.com — Tier A PRIMARY, the lab’s own record. The same-day companion, “The Closed Quorum,” is Talos’s write-up of the first finding, not a substitute for the toolkit post and not an outside wire. The release of CAIRN, the metadata-first method, the cognitive-artifact list, the up-to-24 filters and the named examples, the SQLite corpus with YARA on import, the T1–T3 ontology, the explorer graph and the UMAP caveat, the VirusTotal metadata rule, the July 2025 LAMEHUG and CERT-UA line, the one-year autonomy arc, the evasion-technique observation, the noise caveat, and the “research effort, not a pure active threat signal” line are the CAIRN post’s. The CLOSEDQUORUM description, the four named providers, the no in-the-wild confirmation, the placeholder keys, the dummy webhook, and the carding-forum link are the companion’s. NOT claimed: that this desk ran CAIRN, counted the 24 filters, opened the explorer, confirmed a CLOSEDQUORUM intrusion, named the red-team instructor, copied the implant’s steps, a stock tip, or investment advice. Distinct from the already-filed meta-muse-0day, openai-frontier-standards, and deepseek-unsc-ai-brief.