Cisco's threat intelligence unit, Talos, has launched CAIRN, an open-source framework designed to hunt and analyze malware that integrates artificial intelligence. The toolkit operates by tracking AI-related metadata, such as embedded prompts and API keys, to identify malicious software without needing to analyze the underlying code directly. This initiative aims to help defenders keep pace with the rapid evolution of threats that operationalize AI.
Utilizing the new framework, Talos has already identified a malware implant named CLOSEDQUORUM, which demonstrates fully autonomous command and control (C2) capabilities. This discovery highlights a significant shift where entire phases of a cyberattack can be executed by AI without human intervention, compounding the effects of speed and scale that AI brings to offensive cyber operations. CAIRN is intended to help researchers map these emerging autonomous threats.