Introducing CAIRN: Frontier tracking for AI-integrated malware

This report introduces CAIRN, a metadata-driven research toolkit for hunting AI-integrated malware by extracting and correlating cognitive artifacts (prompts, provider endpoints, API keys, eviction/jailbreak strings) without executing binaries. It describes acquisition filters, a three-tier YARA ontology (T1 primitives, T2 behavioral context, T3 operational families), semantic clustering, and relationship pivoting, and summarizes initial findings showing active AI integration in malware, spreading AI-specific tradecraft, and the need to evolve detection from presence to purpose.