Image: media.wired.com · rights & removal

A New Tool Found Malware That’s Guided by an AI Hive Mind

Reporting by Wired - SecurityRead the original at wired.com

Executive Summary

Cybersecurity researchers from Cisco Talos developed the Cognitive Artifact Intelligence Research Network (CAIRN) framework to classify and analyze malware that incorporates agentic AI components. This framework leverages "vestiges" or fingerprints left by AI integration in digital artifacts to track, classify, and tag malware samples. The system has been used to identify malware with autonomous command-and-control infrastructure, such as CLOSEDQUORUM, which uses multiple large language models to coordinate actions. Researchers observed that early awareness of AI-enabled malware was limited, finding only a few documented examples initially. Through the application of CAIRN, researchers discovered additional examples of AI-integrated malware, suggesting the landscape is more complex than publicly reported. The process has led to the discovery of approximately twenty additional examples of such malware and highlights the operationalization of AI in hacking beyond simple productivity tools.

Facts Only

* Cisco Talos researchers shared an open-source framework named Cognitive Artifact Intelligence Research Network (CAIRN).
* The framework aims to classify and analyze AI-integrated malware by identifying vestiges or fingerprints left behind by AI integration in artifacts.
* CAIRN was used to identify a hacking tool named CLOSEDQUORUM, which uses up to four large language models (LLMs) for command-and-control.
* The framework identified AI-integration characteristics and attributes from metadata to classify and tag malware samples with a unique ID.
* A phishing campaign detected in July 2025 involved malware communicating with the LLM Qwen2.5-Coder-32B-Instruct via a Hugging Face API.
* The CLOSEDQUORUM tool checks multiple AI services (DeepSeek, Qwen, Mistral, Google Gemini) for consensus on next steps.
* Researchers found links between the malware and cybercriminal forums regarding credit card fraud involving login credentials and cryptocurrency.
* Cisco Talos researchers discovered about twenty additional examples of AI-integrated malware through the use of CAIRN.
* The CLOSEDQUORUM malware is Windows malware designed to steal login credentials and cryptocurrency.

Full Take

The narrative shifts from observing nascent AI integration in malware to recognizing its operationalization, which implies a fundamental acceleration in adversarial capabilities. The development of CAIRN suggests that the observable artifacts of AI use—the "vestiges"—offer a measurable signal for tracking complex, autonomous systems previously invisible to traditional fingerprinting methods. This recognition moves security analysis from retrospective pattern matching to real-time behavioral attribution against emergent complexity. The contrast between initial expectations and the eventual discovery of more diverse malware families underscores a critical tension: the speed of adversarial innovation often outpaces the documentation of threats. Furthermore, the observation that AI has moved from being a productivity tool to an operationalized component in hacking means that defensive strategies must adapt not only to patch known vulnerabilities but also to anticipate systems operating under decentralized, self-directing logic, like CLOSEDQUORUM's consensus mechanism. The implication for agency is that if adversaries can use LLMs to create fully autonomous command structures, the reliance on human oversight becomes an increasingly fragile control point, demanding a shift in focus toward understanding emergent system behavior rather than isolated component analysis. Bridge questions include: If artifacts reveal these vestiges, what level of contextual depth is required for the defensive community to effectively intervene against multi-model consensus attacks? How does the increasing autonomy offered by agentic AI reshape the definition of attack attribution? What alternative classification methods should replace reliance on historical fingerprints when systems evolve this rapidly?

From the original · Wired - Security

For years, cybersecurity practitioners have tracked different types of malware and detected potential infections using digital fingerprints to identify different hacking tools and follow their use over time.

Read the full story at wired.com

Sentinel — Human

Confidence

This text reads like journalistic reporting on emerging cybersecurity research, marked by expert testimony and a specific exploration of evolving threat landscapes rather than purely synthetic generation.

Signals Detected

Sentence length variance is natural; the tone shifts between technical reporting and reflective commentary.

The text flows logically, shifting from a framework announcement to specific examples and researcher reflection, demonstrating narrative intent.

Attribution is specific (Cisco Talos researchers, Ryan Fetterman) and links events chronologically and contextually.

The article references specific internal research developments (CAIRN, CLOSEDQUORUM) and named sources with plausible context.

Human Indicators

Presence of direct, reflective quotes from named experts that demonstrate genuine engagement with the subject matter's evolution.

The narrative arc involves an initial expectation vs. later reality regarding AI integration in malware, which implies a human-driven discovery process.