Cisco Talos Uncovers Malware That Consults Multiple AI Models on Its Own

Cisco Talos has disclosed a new open-source framework for spotting malware that uses artificial intelligence, and the team says it has already used the tool to uncover a Windows threat with a fully autonomous command system. The malware, dubbed CLOSEDQUORUM, does not wait for a human operator to tell it what to do; instead, it asks multiple large language models for guidance and acts on the consensus.

The finding matters because it suggests AI-assisted cybercrime is moving beyond isolated experiments and into a more operational phase, even if the overall number of documented cases remains small. It also gives defenders a new way to track malware families that leave behind machine-learning-related clues rather than traditional code signatures alone.

What Cisco Talos announced and why it matters

Cisco Talos introduced a framework called the Cognitive Artifact Intelligence Research Network, or CAIRN, on Monday, positioning it as a way to classify and study malware that incorporates AI services. The system is designed to look for the traces AI leaves behind in metadata and other artifacts, then group related samples into clusters that defenders can investigate over time.

Unlike conventional malware analysis, which often relies on code patterns, hashes, and infrastructure indicators, CAIRN focuses on what researchers describe as “cognitive” fingerprints. Those include signs that a sample has queried AI services, chained prompts into decision-making, or used language models to help steer malicious behavior.

Researchers say the idea is to give cybersecurity teams an early-warning system for a growing class of threats that may not look especially novel at first glance but behave differently once deployed.

“The core idea is that AI integration has these vestiges, like fingerprints, that are left behind,” said Ryan Fetterman, the Cisco Talos security researcher who led development of CAIRN. “That gives us a signal that we can use to track these samples, classify them, and look at what’s happening.”

Fetterman added that the goal is not just detection but broader visibility: how attackers are experimenting, what kinds of behaviors are emerging, and whether today’s rough prototypes are becoming tomorrow’s standard tools.

How CAIRN works

CAIRN is built to identify characteristics associated with AI integration and turn them into usable intelligence. In practice, the framework examines metadata and other attributes tied to a malware sample, assigns a unique identifier, and then compares that sample with others in its growing library.

That approach lets Talos researchers look for patterns across samples that might otherwise be treated as unrelated. A tool that uses one AI service for simple command generation may be grouped differently from a tool that uses several models to make autonomous decisions. CAIRN is intended to reveal those distinctions.

The framework is also meant to help researchers move beyond one-off stories about a single malware family. By organizing samples according to traits and behaviors, Talos hopes to map a larger ecosystem of AI-enabled threats, including how developers swap models, build redundancy, and automate more of the attack process.

Why fingerprints matter in AI malware

AI services leave operational traces in the same way that traditional malware leaves network or binary signatures. Requests to model APIs, references to specific providers, and patterns in prompt-driven logic can all become useful evidence for defenders.

That matters because attackers who depend on AI models often cannot hide those dependencies completely. Even when the malicious code is obfuscated, the workflow can expose clues about which services were used, how many models were queried, and whether the malware was designed to keep running if one provider failed.

Talos argues that those clues can help analysts spot a family resemblance between samples long before the malware becomes widely known.

What did Talos find with the new system?

Using CAIRN over the past few months, Fetterman says he identified roughly 20 additional examples of AI-integrated malware, more than he expected when he began investigating the topic. That result is notable because his earlier review of the field turned up only a small handful of publicly documented families.

In fact, when he first revisited the subject, Fetterman said he found only around nine named malware families that seemed to use AI in meaningful ways, and some of those were research demonstrations rather than operational threats. The discovery of many more examples suggests the landscape is broader than public reporting has captured.

At the same time, Talos does not claim that AI-native malware is suddenly widespread. Instead, the researchers describe the trend as still experimental but more active and diverse than outside observers may realize.

Fetterman said the result changed his own expectations, explaining that the field was not as mature or as heavily documented as he had assumed, but was nevertheless more complex than it first appeared.

That tension is important: AI malware may still be in its early stages, but defenders who wait for it to become common before studying it could be late to the problem.

How did Talos identify CLOSEDQUORUM?

CAIRN helped Talos spot CLOSEDQUORUM, a Windows malware sample that does something unusual even by modern standards: it consults multiple large language models to decide what to do next. Rather than depending on a single AI backend, it polls up to four models and takes direction from the combined answers.

The models named by Talos include DeepSeek, Qwen, Mistral and Google Gemini. If one of the services is unavailable, the malware can still operate by using the others, which makes the system more resilient and less dependent on any one vendor.

Talos describes the result as a closed decision loop. There is no apparent human operator in the middle of the process telling the malware what to do in real time. Instead, the tool appears designed to gather model responses, reconcile them, and move ahead autonomously.

That autonomy is what makes CLOSEDQUORUM unusual. Cybercriminal tools often include automation, but this one appears to push further by using AI as a backend control layer rather than as a simple helper.

What the malware is designed to do

Talos says CLOSEDQUORUM is built to steal login credentials and cryptocurrency. The company also found connections between the malware and cybercriminal forum discussions about credit card fraud dating back to 2025, which suggests some level of underground interest or development around the tool.

However, researchers could not determine who created the malware or confirm whether it has been used successfully in the wild. That uncertainty is common in cybercrime investigations, where code may circulate before it is ever deployed at scale.

The lack of attribution also means Talos is careful not to overstate the maturity of the threat. Still, the design itself is enough to show what attackers may try next.

Why researchers say AI malware is a real shift

The important change is not simply that attackers can now use AI. Hackers have long adopted new technology quickly, and AI is just the latest tool available to them. The bigger shift is that AI can be embedded inside the control logic of malware, making malicious software more adaptive and more scalable.

That means attackers may be able to run more campaigns at once, interact with more targets, and adapt to different environments without requiring as much human labor. It also creates a new class of backend systems that can answer questions, choose tactics, and keep campaigns moving.

Matt Olney, senior director of threat intelligence at Cisco Talos, said AI has moved from being viewed mainly as a productivity booster to something attackers are operationalizing. In his view, that lets them broaden their reach and manage more complex campaigns with an intelligent system behind the scenes.

For defenders, the implication is clear: cybercrime may become more automated, more conversational, and potentially harder to distinguish from legitimate software if analysts do not have better methods for identifying AI use.

What role did earlier cases like LAMEHUG play?

The path to CAIRN began with an earlier disclosure that suggested AI-assisted malware was already becoming a field worth watching. In July 2025, Ukraine’s CERT-UA warned about a phishing operation using malware called LAMEHUG, which connected to the Qwen2.5-Coder-32B-Instruct model through a Hugging Face API to receive commands.

That case convinced Fetterman that there might be a broader wave of AI-enabled malware on the horizon. He expected to uncover a much larger number of examples when he looked back across the threat landscape a year later.

Instead, he found a smaller set than anticipated, which prompted him to investigate more carefully. The result was not the disappearance of the threat, but the realization that publicly documented examples were only part of the picture.

In that sense, LAMEHUG was both an early warning and a clue: it showed that malware could outsource some of its decision-making to an AI service, and it suggested the need for a better classification system to detect similar cases.

How does this change malware tracking?

It changes malware tracking by adding a new layer of intelligence analysis on top of traditional reverse engineering. Security teams have long identified malware by hashes, file structure, infrastructure, and behavioral indicators. AI-integrated malware asks them to pay attention to the model interactions, service dependencies, and prompt-based control loops as well.

That matters because the same malware family may evolve rapidly if its operators can swap models or change the way prompts are used. A system like CAIRN gives researchers a way to notice those shifts without treating each sample as a completely separate problem.

It also creates a pathway for defenders to compare the behavior of samples across time. If several malware families show similar AI dependencies, or if the same developers appear to reuse the same workflow, analysts may be able to predict future tactics earlier than before.

Potential defensive benefits

• Faster identification of AI-assisted malware families
• Better grouping of related samples despite superficial differences
• Earlier warning about new attacker workflows
• More context on which AI services are being abused
• Improved visibility into whether autonomous malware is spreading

What makes CLOSEDQUORUM stand out technically?

CLOSEDQUORUM stands out because it appears to have been built with redundancy and autonomy in mind. Rather than depending on one model endpoint, it checks several providers and can continue operating if one is unavailable. That makes it more robust than malware that simply calls a single AI API for help.

It also highlights a change in how cybercriminal tooling may be designed. Instead of only using AI to write phishing text or help with code development, attackers can integrate AI into the runtime logic of the malware itself.

In practical terms, that means the AI is no longer just a pre-attack assistant. It becomes part of the attack system.

What should defenders watch next?

Defenders should watch for signs that AI integration becomes more common, more hidden, and more modular. Today’s examples may still be experimental, but the logic behind them could be copied quickly if criminals see value in automation and resilience.

Security teams will likely need to pay attention to unusual API calls, model-specific metadata, and malware that appears to make decisions based on external language-model responses. They may also need to adapt their threat-hunting workflows so that AI use is treated as a meaningful indicator rather than a novelty.

At the policy level, the findings may also intensify questions about how commercial AI providers can monitor abuse of their systems, especially if malicious software can query multiple services in parallel.

For now, the clearest takeaway is that AI-enabled malware is no longer hypothetical. The threat may still be limited in scale, but researchers now have evidence of tools that use large language models not as decorations, but as active participants in an attack chain.

Timeline of key developments

The bottom line

Cisco Talos is betting that the next phase of cyber defense will require a new lens: one that can spot not just malicious code, but malicious use of AI inside the code. The CAIRN framework is Talos’ attempt to build that lens, and CLOSEDQUORUM is its clearest proof so far that the approach is needed.

Whether AI malware becomes common next year or remains a specialized threat for longer, the finding changes the conversation. Attackers have already shown they can use language models to guide malware decisions. Defenders now have to learn how to spot the fingerprints left behind.