Cisco Talos Releases Framework for Detecting AI-Powered Malware, Discovers First LLM-Directed Attack Tool

Cisco Talos researchers on September 22, 2026, published CAIRN, an open-source detection framework for identifying malware that delegates tactical decision-making to commercial large language models, and immediately documented the first known case: CLOSEDQUORUM, a Windows malware that queries four AI models in sequence to decide what destructive action to take next.