Ryan Fetterman's open-source CAIRN surfaced CLOSEDQUORUM, a Windows implant whose AI voting loop is confirmed, though live attacks are not.
By [RuntimeWire Staff](https://runtimewire.com/author/runtimewire-staff)
· Published
Primary source: [Cisco Talos](https://blog.talosintelligence.com/introducing-cairn-frontier-tracking-for-ai-integrated-malware)
Why it matters #
CAIRN gives defenders a way to track AI-specific traces before autonomous malware is widespread, while CLOSEDQUORUM shows that bounded attack decisions can already be handed to commercial models.
Cisco Talos released CAIRN on September 22nd, giving security researchers an open-source framework for finding malware that has begun to leave a new class of fingerprint: prompts, model endpoints, API-key patterns and tool-calling instructions. The first finding from the project is a Windows implant that delegates tactical decisions to a panel of four large language models.
Security researcher Ryan Fetterman led the development of CAIRN, short for Cognitive Artifact Intelligence Research Network. The name refers to the stacks of stones used to mark a trail. Fetterman's premise is that malware developers also leave markers when they wire AI services into their code, even when investigators cannot safely download or execute the underlying binary.
Fetterman previously led Splunk's SURGe security research group, co-created the PEAK Threat Hunting Framework and served as lead author of "The Threat Hunter's Cookbook." His work on CAIRN began with a result that seemed too small.
In July 2025, Ukraine's CERT-UA documented LAMEHUG, malware that contacted Qwen2.5-Coder-32B-Instruct through a Hugging Face API to obtain commands. Fetterman expected that disclosure to precede a wave of AI-integrated malware. When he reviewed the public record in summer 2026, he found about nine named families, including research proofs of concept.
"It just wasn't what I was expecting," Fetterman told WIRED. He responded by building a system that could search for the traces of AI integration at greater scale. After several months of development and use, Fetterman said CAIRN surfaced about 20 additional examples. The figures describe different units: the original nine were named malware families, while the later 20 were additional examples collected through CAIRN. Cisco Talos has not published enough detail to determine how many of those examples represent active threats, incomplete tools or experiments.
Hunting the metadata instead of every binary
CAIRN searches metadata for provider endpoints, embedded prompts, API-key prefixes, local-model runtimes, AI-analysis evasion strings and function-calling syntax paired with offensive capabilities. It can also incorporate antivirus labels, extracted domains, sandbox behavior and executable resource strings.
CAIRN stores the resulting material in a SQLite corpus, runs YARA rules during import and organizes findings into three tiers. The first identifies basic AI artifacts. The second adds behavioral context, such as a provider endpoint appearing alongside command-and-control behavior. The third assigns a known operational family when the available evidence supports attribution.
The framework combines those rules with semantic clustering and relationship graphs. That lets an analyst start with one suspicious file and search for related infrastructure, samples or families without executing each candidate. Cisco Talos cautions that clusters produce leads rather than conclusions. Common application frameworks can expose AI-related strings even when a file has no malicious AI capability, and each significant finding still requires validation.
That limitation is central to CAIRN's value. AI components are spreading into ordinary software, so the mere presence of a model endpoint is already a weak signal. CAIRN attempts to capture purpose by looking for combinations of artifacts and behaviors, then hands the result to an analyst for deeper work.
CLOSEDQUORUM gives four models a vote
CAIRN's first public case study, CLOSEDQUORUM, is a 16.4 MB, 64-bit Windows executable compiled in Go. Cisco Talos found code for credential theft, browser-password collection, cryptocurrency-wallet extraction, process injection and persistence.
The distinctive component is its command loop. CLOSEDQUORUM can sequentially query DeepSeek, Qwen, Mistral and Google Gemini with information about an infected machine. Each model returns a structured choice from a constrained menu of actions. The implant tallies the responses and executes the option with the most votes.
The architecture provides redundancy when a provider refuses a request, times out or returns malformed output. Its voting system also has a revealing shortcut: DeepSeek wins a tie because the code checks model responses in a fixed order, followed by Qwen, Mistral and Gemini. The committee has a chair after all.
CLOSEDQUORUM can send the winning action, model reasoning and attack telemetry to an operator through a Discord webhook. The same channel is designed to receive stolen material encrypted with AES-256-GCM and encoded in Base64. Cisco Talos assesses that a developer could compile customized copies containing each operator's model credentials and webhook, leaving delivery to the buyer.
The evidence stops short of an active campaign. Cisco Talos confirmed the autonomous decision loop through static analysis and examined development builds showing that provider credentials could be inserted during compilation. The publicly distributed sample contained placeholder API keys and a dummy Discord webhook, so researchers did not observe a complete end-to-end execution. Cisco Talos linked artifacts to carding-related criminal-forum activity dating to 2025, but has not identified the developer or confirmed use against real targets.
That distinction narrows the "no humans" claim. People still had to design the malware, implement its capabilities, configure a build and deliver it to a machine. CLOSEDQUORUM removes the operator from a bounded phase after deployment: choosing among prewritten actions based on host context. It is autonomous inside a box that a human built.
The attacker trades attention for API dependence
CLOSEDQUORUM shows why AI command systems could appeal to malware operators. A conventional command-and-control server gives defenders a domain, address, certificate or protocol to track. This design sends requests to model providers used by legitimate applications, while reducing the amount of ongoing direction required from an operator.
It also introduces failure points. Provider refusals, rate limits, service outages, invalid JSON and predictable tie-breaking can stall or distort the decision process. The implant still relies on familiar and detectable behaviors when it dumps credentials, injects processes, establishes persistence or contacts Discord.
Cisco Talos therefore recommends behavioral detection rather than blocking model providers outright. A Windows process contacting one AI service may be ordinary. A process polling several model APIs while accessing LSASS, creating persistence and sending data to a Discord webhook is a much narrower pattern.
The qualification matters in a market where autonomous-attack claims regularly outrun the evidence. Expel's assessment of AI malware argues that end-to-end autonomous attacks still depend on pipelines and direction created by people. CLOSEDQUORUM does not overturn that conclusion. It provides a concrete example of a human-built pipeline handing one tactical stage to several models.
Fetterman's larger contribution is a method for finding these experiments before they become routine. CAIRN turns the AI layer itself into an investigative surface, while preserving reverse engineering as the step that separates a suggestive cluster from an operational malware family.
Cisco Talos calls CAIRN a research effort rather than a pure active-threat signal. That is the right boundary for its first release. The framework has already found that the public catalog of AI-integrated malware was incomplete. CLOSEDQUORUM shows what was hiding outside it: an inert public sample with a verified autonomous architecture, built from ordinary model APIs and familiar malware techniques.