Cisco Talos has introduced CAIRN, a research toolkit designed to detect, classify, and link malware samples that integrate artificial intelligence. The project proposes a metadata-based methodology that lets researchers investigate these programs without downloading or executing their binaries, using traces such as references to model providers, prompt templates, orchestration mechanisms, and other artifacts tied to AI use, a research push that follows Cisco’s broader push on securing AI-driven systems across the enterprise.
CAIRN in 30 seconds
- CAIRN is a Cisco Talos toolkit for investigating AI-integrated malware.
- The system works with metadata, without needing to download or run the analyzed binaries.
- It uses up to 24 filters, YARA rules, semantic clustering, and relationship graphs.
- Talos has identified an evolution from optional AI features to samples with greater autonomy.
- The company has released CAIRN as a research project so the community can extend its filters and rules.
Cisco Talos starts from a simple premise: when a malicious program incorporates artificial intelligence, it also leaves traces related to that integration. These can include references to model services, tool-calling structures, signs of locally run models, or even text designed to influence automated analysis systems.
Talos calls these elements “cognitive artifacts” and uses them as the starting point for a metadata-centered research methodology. The approach makes it possible to search for relationships between samples without initially relying on direct analysis of the malware’s code.
CAIRN stands for Cognitive Artifact Intelligence Research Network and is presented as a toolkit for locating, classifying, and tracking the evolution of AI-integrated malware. Talos has also released the project as open source and plans to progressively expand on the findings of its initial research.
The company defines AI-integrated malware as malware that operationalizes, attacks, or exploits artificial intelligence systems and their ecosystems. The category ranges from the functional integration of AI within an attack chain to the compromise of credentials and infrastructure tied to these services.
A metadata-based search
CAIRN works without downloading or running the analyzed files. The system uses information that is already available about the samples, including extracted strings, sandbox behavior, and antivirus detection labels.
The tool has up to 24 acquisition filters to locate indicators related to artificial intelligence. Some look for references to model providers, while others identify code patterns tied to AI development frameworks or signs of local model execution.
There are also filters aimed at detecting text used to try to evade AI-based analysis systems, as well as patterns associated with agentic tooling. The goal isn’t to automatically assume that any of these indicators proves the presence of AI-powered malware, but to generate candidates that can be studied further.
Results are stored in a SQLite database and processed using YARA rules. Talos has organized the classification into three tiers.
Tier 1 (T1) identifies primitive AI-related artifacts, such as references to services or specific call structures. Its role is to determine that elements related to this technology exist.
Tier 2 (T2) adds behavioral context. Combining different indicators can provide signals about the operational use of AI, although it doesn’t by itself constitute a definitive attribution.
Tier 3 (T3) is used to identify AI malware families when confirmed operational fingerprints exist. Talos stresses that final conclusions require validation through reverse engineering.
This distinction makes it possible to separate the mere presence of AI references from genuinely functional integration. It’s an important difference, since certain programs can contain strings related to artificial intelligence tools without actually using them.
CAIRN combines YARA, graphs, and semantic analysis
One of the central parts of CAIRN is its relationship explorer. The tool builds a graph connecting samples through metadata attributes, such as domains, certificates, submission information, or specific identifiers.
When researchers find a sample of interest, they can use these relationships to search for other variants, shared infrastructure, or components linked to the same campaign.
This lets researchers expand an investigation from a single file to a broader set of related samples. Talos poses questions such as whether other variants of the same family exist, what infrastructure different samples share, or what additional loaders and components show up in a given campaign.
CAIRN also incorporates YARA rules for classification tasks. Unlike traditional rules created after a full reverse-engineering process, CAIRN’s rules have to work with the information visible in the available metadata.
This limits the precision that can be achieved compared with direct binary analysis, but it allows a larger volume of samples to be investigated without needing to download each file. Talos considers this approach a complement to, not a replacement for, traditional analysis techniques.
The fourth strategy is semantic discovery. CAIRN uses embedding models to find samples whose metadata shows similarities even when they don’t necessarily share the same visible strings.
To build this representation, the system combines antivirus detection labels, extracted domains and URLs, content fragments, executable resource information, and behavior patterns captured during sandbox execution.
The explorer can visualize these similarities using UMAP and HDBSCAN, techniques used to identify clusters within large datasets. Talos warns that belonging to the same cluster doesn’t confirm that two samples belong to the same family. The clusters are meant to generate leads that must then be reviewed individually.
Talos tracks a rapid evolution of AI malware
The first investigations carried out with CAIRN trace back to samples observed since July 2025, the period in which Talos places the first publicly identified cases of AI-integrated malware, including LAMEHUG, which the company links to CERT-UA’s analysis.
One pattern Talos highlights is a shift toward higher levels of autonomy. According to its observations, the trend has moved from incorporating a language model as an optional feature to building systems with multiple models and coordination mechanisms capable of operating without direct human input.
The research also found evidence that certain techniques designed to hinder AI-based analysis can spread between different threat actors. Talos describes a case in which a technique based on instructions aimed at automated analysis systems later appeared in unrelated samples.
The company does add an important caveat: finding AI indicators doesn’t necessarily mean a sample uses artificial intelligence in a functional way. False positives are common, especially in certain types of packed or compiled applications.
That’s why CAIRN treats initial indicators as signals to expand an investigation. Confirming that real AI integration exists requires reviewing each sample individually and, when necessary, resorting to reverse engineering.
CAIRN’s release aims precisely to support that work as the number of programs incorporating artificial intelligence grows. Talos believes the filters, currently focused on the presence of AI references, will need to evolve toward mechanisms capable of determining the specific purpose of that integration.
The company also notes that the project should still be considered a research initiative, not a signal of an active threat by itself. Its value lies in providing a methodology that lets security teams look for emerging patterns and link samples at a larger scale.
By releasing the code and methodology, Talos hopes researchers and defenders can expand the filters, rules, and classification mechanisms. The goal is to keep CAIRN as a complement to conventional malware-analysis techniques as attackers’ use of artificial intelligence continues to evolve.
Frequently asked questions
What is Cisco Talos’s CAIRN?
CAIRN is a research toolkit that Cisco Talos has developed to detect, classify, and link malware that integrates artificial intelligence.
Does CAIRN execute malicious files?
No. The methodology works from metadata and doesn’t require downloading or running the binaries to carry out the first phase of detection and linking between samples.
What techniques does CAIRN use?
CAIRN combines acquisition filters, YARA rules, relationship analysis through graphs, and semantic discovery using embedding models.
Can CAIRN confirm on its own that malware uses AI?
Not necessarily. Talos warns of the existence of false positives and notes that interesting results must be validated through individual sample analysis and, where appropriate, reverse engineering.
