AI-integrated malware is malicious software that calls a large language model at runtime to make decisions, and in September 2026 defenders got two milestones at once: Cisco Talos disclosed CLOSEDQUORUM, the first publicly documented malware that uses a panel of commercial LLMs as its command-and-control layer, and released CAIRN, an open-source toolkit for hunting this whole category. Both landed on September 22, 2026.
The defensive problem is what makes this worth understanding. When malware's "instructions" arrive as an ordinary HTTPS call to a mainstream AI provider, the domain-blocking and beacon-detection playbook that defenders have relied on for two decades stops working. The signal moves from where the traffic goes to how the endpoint behaves.
This article is written for defenders. It covers what AI-integrated malware is, why it breaks conventional detection, the behavioural signals that still work, and how CAIRN finds these samples without ever running them.
Key Takeaways
- AI-integrated malware calls an LLM at runtime to pick its next action, so its C2 traffic looks like a normal AI API request.
- CLOSEDQUORUM, disclosed September 22, 2026, is the first documented sample to use commercial LLM providers as its C2 layer.
- Domain blocking fails here because the endpoints are legitimate AI services many real applications also use.
- Detection shifts to behaviour: unexpected processes making AI-provider calls alongside credential access, injection or persistence.
- Cisco Talos released CAIRN, an open-source toolkit that finds these samples from metadata alone, without downloading or executing binaries.
What is AI-integrated malware?
AI-integrated malware is malicious software that offloads part of its decision-making to a large language model while it runs. The malicious capabilities — stealing data, moving through a network, staying resident — are ordinary compiled code. What the model supplies is the strategy: which capability to use, and when.
That division is the key to reasoning about the threat, and it is where a lot of coverage overstates things. The AI does not invent new attack techniques on the fly. It selects among techniques the malware already carries. Cisco Talos, in its analysis of CLOSEDQUORUM, is careful about this: the sample delegates tactical command-and-control decisions to a panel of models, rather than having them write code.
Talos traces the category back to July 2025, when the first AI-integrated samples (a family it calls LAMEHUG) were reported. CLOSEDQUORUM is the point where the AI became the command channel itself rather than a helper bolted onto a conventional one.
It is worth separating this from the other AI-security stories of 2026:
- AI as the operator — an autonomous agent runs an intrusion end to end, as in JADEPUFFER, the first autonomous AI ransomware attack.
- AI as the tactician — malware carries a fixed toolkit and asks a model which tool to use. This is CLOSEDQUORUM.
- AI as the target — attacks against the models and pipelines themselves, which we covered in AI coding agent security.
CLOSEDQUORUM's actual capabilities are modest and its lateral-movement module was unfinished in the analyzed build. Talos found no confirmation it was ever deployed in the wild. The reason it matters is architectural, not because of what this one sample can do.
Why does it break conventional detection?
It breaks conventional detection because the malware's command channel is a legitimate service. Traditional defences work by finding the attacker's infrastructure — a suspicious domain, a hard-coded IP, a beaconing pattern to an unusual host. When the "C2 server" is a mainstream AI provider that thousands of real applications also call, there is no bad destination to block.
Walk through what a defender normally keys on, and what happens when the C2 is an AI API:
| Traditional signal | Why it usually works | Why it fails here |
|---|---|---|
| Known-bad domain or IP | Attacker infrastructure is reused and catalogued | The endpoint is a legitimate, widely used AI service |
| Regular beacon interval | Malware phones home on a fixed timer | Requests can be spaced irregularly and look like app traffic |
| Unusual TLS or protocol | Custom C2 stacks look different from browsers | Requests use standard HTTPS to a normal API |
| Signature of a fixed command set | Static C2 has predictable commands | Instructions are generated fresh by a model each time |
The last row is the deepest problem. Signature-based detection assumes the malicious logic is in the file. With AI-integrated malware, part of the logic is produced at runtime, outside the binary, by a system you cannot inspect. Two runs of the same sample can behave differently because the model's responses differed.
Blocking the AI providers wholesale is not a real option either. DeepSeek, Qwen, Mistral and Gemini — the providers CLOSEDQUORUM was built to consult — are the same services legitimate software uses every minute. Blanket-blocking them breaks business applications and, in most environments, is politically and operationally impossible. As enterprises adopt the kind of models we tracked in our LLM API pricing guide, API calls to these providers become normal background noise.
What detection actually works?
Behavioural detection works. Because the malicious capabilities are still ordinary code — reading credential stores, injecting into processes, writing persistence — those actions remain visible on the endpoint. The reliable signal is the combination: an unexpected process making AI-provider API calls at the same time it touches credentials, injects code or installs persistence.
This is Talos's own guidance, and it is the practical core of this article. No single one of these is malicious on its own; the correlation is.
Signals to correlate:
- AI-provider API traffic from an unexpected process. A browser or a known AI app calling an LLM endpoint is normal. A random executable in a temp directory doing it is not.
- Requests to several model providers in a short window. Legitimate apps generally pick one provider. Fanning out to several within seconds is unusual.
- Classic offensive behaviours — access to LSASS memory, process injection, WMI or scheduled-task persistence — occurring in the same process that is also making AI calls.
- Telemetry tampering, such as attempts to disable Event Tracing for Windows, immediately before the AI traffic starts.
- Data-shaped egress to consumer platforms, for example encrypted blobs posted to a chat-app webhook, near the same process.
The mental model is a join, not a filter. Here is the logic expressed as pseudocode against a hypothetical endpoint-telemetry table — a way to think about a hunt query, not a drop-in rule:
-- Hunt: processes that both call AI providers AND perform offensive actions.
-- Neither condition alone is suspicious; the overlap is the signal.
SELECT p.host, p.process_id, p.image_path
FROM process_events p
WHERE p.process_id IN (
SELECT process_id FROM network_events
WHERE dest_host IN ('api.deepseek.com','api.mistral.ai',
'generativelanguage.googleapis.com','dashscope.aliyuncs.com')
)
AND p.process_id IN (
SELECT process_id FROM security_events
WHERE action IN ('lsass_handle_open','remote_thread_create',
'wmi_subscription_create','etw_provider_disabled')
)
AND p.image_path NOT IN (SELECT image_path FROM approved_ai_applications)
The approved_ai_applications allowlist is what makes this tractable. In a mature environment you know which binaries are supposed to talk to AI services. Everything else calling those endpoints is worth a look, and anything doing so while also touching credentials is an alert.
Two supporting controls make the behavioural approach stronger:
- Egress awareness for AI endpoints. You do not have to block the providers to log and baseline which processes reach them. That baseline is what turns "an executable called an AI API" into "an executable that has never called an AI API before just did."
- Standard credential-theft and injection hardening. Everything CLOSEDQUORUM's toolkit does is a known technique. Protections against LSASS access and unsigned code injection reduce the impact regardless of how the malware picks its actions.
What is CAIRN?
CAIRN (Cognitive Artifact Intelligence Research Network) is an open-source toolkit Cisco Talos released for hunting, classifying and tracking AI-integrated malware. Its defining trait is that it works entirely from metadata — strings, sandbox behaviour, PE resources — without downloading or executing any binary. It is published on GitHub for defenders to run.
The design principle behind it, from Talos's introduction to CAIRN, is that attackers building AI-integrated malware "unintentionally (and inevitably) leave behind markers of their own: prompt templates, provider endpoints, API keys, jailbreak terms, and other artifacts." Those markers are exactly what an LLM-driven implant needs to function, so it cannot avoid carrying them.
CAIRN's pipeline has three stages:
- Extract AI-integration artifacts from metadata — VirusTotal strings, sandbox behaviour, AV labels, PE static-analysis results and ExifTool resource strings.
- Classify each sample against a three-tier YARA ontology and build a unique representation of it.
- Cluster and graph the relationships between samples so an analyst can pivot from one to related ones.
The classification tiers are a clean way to think about the evidence:
| Tier | What it captures | Example |
|---|---|---|
| T1 — primitive artifacts | Raw AI integration | LLM API endpoints, tool-calling syntax |
| T2 — behavioural context | How the AI is used | Analysis-evasion text, known C2 patterns |
| T3 — operational families | Confirmed attribution | A named malware family such as CLOSEDQUORUM |
CAIRN ships around two dozen acquisition filters to expand a corpus — for example, samples that import AI frameworks such as langchain or litellm, that bundle a local model runtime such as ollama or llama.cpp, or that contain text addressed at AI analysis systems. Analysts run cairn explorer to launch the relationship graph and cairn rescan to re-apply updated rules offline.
The reason a metadata-only approach matters is safety and scale. You can classify thousands of samples without ever detonating one, and you can share the artifacts (a provider endpoint, a jailbreak phrase) as intelligence without distributing a working binary. That is the right shape for a defensive tool.
What should defenders do now?
Start by mapping which processes in your environment legitimately use AI APIs, then alert on anything outside that set that combines AI-provider traffic with credential access, injection or persistence. This is a threat to prepare for rather than react to: the technique is documented, the tooling to hunt it is public, and there is no confirmed in-the-wild campaign yet.
A practical order of operations:
- Baseline AI-API egress. Log which internal processes reach LLM providers. You cannot spot the anomalous caller until you know the normal ones.
- Deploy behavioural correlation. Use the join pattern above in your EDR or SIEM: AI traffic plus offensive behaviour in the same unapproved process.
- Adopt CAIRN for hunting. It is open source and metadata-only, so it carries no detonation risk. Use it to check whether related samples touch your telemetry.
- Harden the fundamentals. LSASS protection, blocking unsigned injection, monitoring WMI and scheduled-task persistence, and watching for ETW tampering all still apply — the AI layer does not change what the payload does.
- Watch your own AI supply chain. The flip side of malware calling AI is attackers targeting the AI tools your developers use. Our guide to AI coding agent security covers that surface.
The strategic point for security leaders: this is the third distinct AI-security category to appear in 2026, after autonomous attack agents and attacks on AI pipelines. Treat "which processes may talk to AI providers, and what else are they doing" as a monitored control, the same way you already monitor which processes may open outbound connections at all.
Frequently asked questions
What is AI-integrated malware? AI-integrated malware is malicious software that calls a large language model at runtime to decide its next action. The harmful capabilities are ordinary compiled code; the AI chooses which capability to run, which is what distinguishes it from conventional malware with a fixed command set.
What is CLOSEDQUORUM? CLOSEDQUORUM is a Windows implant disclosed by Cisco Talos on September 22, 2026, described as the first publicly documented malware to use commercial LLM providers as its command-and-control layer. Talos found no confirmation that it was deployed in the wild.
Why can't antivirus just block the AI provider? Because those providers are legitimate services that many business applications use. Blanket-blocking them would break real software, so defenders rely on behaviour — an unexpected process making AI calls while also stealing credentials or injecting code — rather than blocking the destination.
How do you detect AI-integrated malware? Through behavioural correlation. The reliable signal is a single unapproved process that both makes AI-provider API calls and performs offensive actions such as accessing LSASS, injecting into other processes or installing persistence. Neither behaviour alone is malicious; the combination is.
What is CAIRN? CAIRN is an open-source toolkit from Cisco Talos for hunting AI-integrated malware. It analyzes samples from metadata alone — strings, sandbox behaviour, PE resources — without downloading or running the binary, and classifies them with a three-tier YARA ontology.
Is AI-integrated malware a major threat today? Not yet in terms of active campaigns. Documented samples so far have limited capabilities and no confirmed in-the-wild use. The concern is the architecture, which defeats infrastructure-based detection, so the value now is in preparing behavioural monitoring before a capable campaign appears.
The verdict
AI-integrated malware is a real shift in how intrusions can be commanded, and the honest framing is that the danger is architectural rather than immediate. CLOSEDQUORUM's toolkit is unremarkable and possibly never deployed. What it proves is that malware can hide its command channel inside legitimate AI traffic, and that quietly retires infrastructure-based detection for this class of threat.
The good news is that defenders got the countermeasure in the same week as the threat. The payload still has to act on the endpoint, those actions are still visible, and CAIRN gives teams a safe, open way to hunt the category at scale. The work is to baseline which processes may use AI services and alert on the ones that shouldn't — before there is a campaign forcing the issue.
For the adjacent risk of attackers targeting the AI tools inside your own pipeline, read AI coding agent security next.
The command server used to be a place you could block. Now it's a conversation you have to notice.
