Cisco Talos has released an open-source toolkit called CAIRN for finding and sorting malware that meaningfully uses, targets or exploits AI systems. The aim is not to decide whether a file merely contains an AI-related string, but to give defenders a way to find the technical traces that can show AI is part of an attacker's workflow.
The unusual part is its starting point. CAIRN works from metadata exposed around a file, rather than downloading or running the malware itself. Talos says it can look for artifacts such as embedded prompt templates, model-provider endpoints, orchestration logic, API-key prefixes and text meant to evade AI analysis tools. That makes it useful for broad hunting, but it also puts a hard limit on what the results mean.
Signals are not verdicts
CAIRN places its findings in three tiers. The first establishes that AI-related artifacts are present. The second adds behavioral context, looking for combinations that suggest an operational use rather than an incidental dependency. The third is reserved for confirmed, named malware families.
Talos explicitly warns that the early tiers can be noisy. Packaged software can expose strings from an entire development environment, and samples that land in the same metadata cluster are only weakly similar until an analyst inspects them. The company says reverse engineering is still needed for a final verdict. In other words, CAIRN is a way to prioritize and connect leads, not a substitute for proving what a binary does.
A first case study, with a caveat
Talos' first published CAIRN finding is a Windows implant it calls CLOSEDQUORUM. Help Net Security reports that the sample asks a panel of commercial language models to choose its next move from a fixed menu, then executes the winning choice. The menu described in the report includes data theft, code injection and persistence.
That is a more autonomous command-and-control pattern than the usual model of an operator or attacker-controlled server issuing each instruction. But the qualification matters: Talos' researchers statically confirmed the decision loop, while the version they examined contained placeholder API keys and a dummy webhook. They did not see it run end to end against a live target.
The practical takeaway for defenders is modest but useful. As AI components appear in more offensive tooling, metadata can reveal relationships and suspicious artifacts before every sample receives a full manual teardown. CAIRN makes that preliminary work repeatable, while Talos' own cautions keep the more dramatic conclusion in check: a new hunting method and one limited case study do not, by themselves, establish a broad new class of fully autonomous attacks.
