Cisco Talos develops framework to detect AI‑driven malware

Cisco Talos, the security research arm of Cisco, unveiled a novel detection framework designed to spot malware and hacking tools that leverage AI chatbots for command‑and‑control, credential harvesting, or code generation. The system combines static code analysis with behavioral monitoring of network traffic, flagging anomalous interactions with large‑language‑model APIs and correlating them with known malicious signatures. By integrating threat‑intel feeds and sandboxed execution, the framework can automatically classify suspicious binaries that embed prompts or API keys for services such as OpenAI’s ChatGPT, Google Gemini, or Anthropic Claude.

During early testing, Talos researchers observed an unexpected trend: a growing number of benign security and development tools were also embedding AI‑chatbot calls, blurring the line between legitimate and malicious usage. The findings prompted the team to refine the framework’s heuristics, adding contextual awareness to differentiate routine automation from covert exploitation. Talos plans to share the methodology with industry partners to improve collective defenses against the emerging class of AI‑assisted threats.