Cisco Talos Finds AI Hive Mind Malware with No Human Operators
Original: A New Tool Found Malware That’s Guided by an AI Hive Mind—No Humans in Sight
Why This Matters
Autonomous malware that self-directs via LLMs removes human operators from the attack loop—a structural shift in threat response timelines.
Cisco Talos released an open-source framework called CAIRN on September 22, 2026, designed to detect AI-integrated malware. Using it, researchers found CLOSEDQUORUM—malware that autonomously polls up to four LLMs for commands, with no human operator in the loop.
Cisco Talos researcher Ryan Fetterman led development of CAIRN (Cognitive Artifact Intelligence Research Network), an open-source framework that fingerprints malware samples for signs of AI integration. The name mirrors trail cairns—stone markers that signal something worth noting. CAIRN extracts metadata artifacts, assigns unique IDs to samples, and groups them to surface trends.
Using the tool, Fetterman's team identified a malware strain they're calling CLOSEDQUORUM: a fully autonomous command-and-control system that polls up to four LLMs simultaneously and acts on whatever consensus emerges—no human attacker required at runtime.
The backstory starts in July 2025, when Ukraine's CERT-UA flagged a phishing campaign using malware dubbed LAMEHUG, which queried Alibaba's Qwen2.5-Coder-32B-Instruct model via a Hugging Face API for real-time instructions. Fetterman expected that discovery to be the tip of a large iceberg. Instead, a summer 2026 retrospective turned up only roughly nine named AI-integrated malware families—several of them researcher-created proofs of concept.
'There really wasn't a lot there,' Fetterman admits. After months with CAIRN, he has added about 20 more examples, but still characterizes AI-integrated malware as 'largely experimental for attackers.' CAIRN is now public, and Talos hopes the wider security community will use it to catalog and track this category before it matures.