A New Tool Found Malware That’s Guided by an AI Hive Mind—No Humans in Sight

Cisco Talos researchers released CAIRN, an open-source framework to identify and classify AI-integrated malware artifacts; using it they documented instances such as CLOSEDQUORUM (which polls multiple LLMs for C2 directives) and LAMEHUG (a phishing-delivered implant that queried an LLM via Hugging Face), and reported discovering additional examples of AI-enabled malware while noting relatively few documented cases prior to their work.