Cisco Talos finds malware taking orders from a four-model committee
Ryan Fetterman's open-source CAIRN surfaced CLOSEDQUORUM, a Windows implant whose AI voting loop is confirmed, though live attacks are not.
By RuntimeWire Staff · Published
Primary source: Cisco Talos
Why it matters
CAIRN gives defenders a way to track AI-specific traces before autonomous malware is widespread, while CLOSEDQUORUM shows that bounded attack decisions can already be handed to commercial models.
Cisco Talos released CAIRN on September 22nd, giving security researchers an open-source framework for finding malware that has begun to leave a new class of fingerprint: prompts, model endpoints, API-key patterns and tool-calling instructions. The first finding from the project is a Windows implant that delegates tactical decisions to a panel of four large language models.…
When you purchase through links in our articles, we may earn a small commission. This doesn’t affect our editorial independence.