New Framework Detects Autonomous AI Hackers

Cybersecurity researchers have introduced a novel open-source framework to tackle the growing threat of AI-integrated malware. Developed by Cisco Talos, the Cognitive Artifact Intelligence Research Network (CAIRN) aims to classify and analyze malware that leverages artificial intelligence, much like digital fingerprints identify known threats. CAIRN works by flagging AI integration characteristics from metadata, assigning unique identifiers to malware samples, and analyzing them against a library to reveal trends and connections.

This new system has already proven effective, identifying an autonomous hacking tool named CLOSEDQUORUM. This malware utilizes multiple large language models (LLMs) to develop a consensus for its actions within a target system, creating a fully closed command-and-control infrastructure with no human input. Researchers found links between CLOSEDQUORUM and cybercriminal forums discussing credit card fraud, with its objective being to steal login credentials and cryptocurrency.

While initial expectations of a surge in AI-powered malware were high, with only a few documented examples found last year, CAIRN’s ongoing analysis has uncovered approximately 20 additional instances of AI-integrated malware. This suggests the landscape is more complex than publicly reported. Experts note that AI is moving beyond a productivity tool to become an operational asset for attackers, enabling them to manage more campaigns and diverse systems by leveraging intelligent backend support.

A previous instance of AI malware, LAMEHUG, was identified in July 2025 by Ukraine’s CERT-UA. This implant communicated with an LLM through a Hugging Face API to receive commands, highlighting an early example of AI's offensive capabilities.