Hunting AI Malware: CAIRN, Closed Quorum & Anti-Analysis Prompt Injection | Ep21

The Threat Intelligence Podcast · Oct 29, 2026 · 24m

The attacker deploys the malware, then sits back and lets AI models vote on what it does next. Ryan Fetterman, AI and security researcher at Cisco Talos and author of The Threat Hunter's Cookbook, joins Rachel James and Dr. Bryan Nakayama to explain how his CAIRN research network tracks AI-integrated malware.

We dig into Closed Quorum, the first publicly reported LLM-driven command and control, where multiple models vote on the implant's next move. We also cover malware that embeds prompt injection to fool AI analysis tools, and how CAIRN moves from spotting AI strings to understanding their…