CAIRN Open-source research toolkit (Cognitive Artifact Intelligence Research Network) for hunting, classifying, and tracking AI-integrated malware entirely from metadata. It extracts cognitive artifacts such as embedded prompts, LLM provider endpoints, orchestration logic, and evasion strings, then classifies samples into three tiers using YARA rules, semantic clustering, and relationship graphs without downloading or executing binaries.