Researchers found malware that takes its orders from a committee of four AIs, with no human

Malware has always needed a human somewhere behind it — an operator sending commands, deciding the next move. Researchers say they have now found a piece of malware built to do without one.

Cisco Talos, the security arm of Cisco, has disclosed a Windows implant it calls CLOSEDQUORUM, describing it as the first publicly documented malware to apply AI to its own command-and-control — the part of an attack that decides what to do next.

How It Works

The design is the story. Once CLOSEDQUORUM is on a machine, it does not wait for orders from an attacker-run server. It delegates the choice of its next action to a panel of commercial AI models and then carries out whatever they decide.

The panel — the 'quorum' in the name — draws on up to four AI providers: DeepSeek, Qwen, Mistral and Google's Gemini. The stated goal of the malware is ordinary enough: stealing user credentials and cryptocurrency wallets. What is new is who is steering.

Why 'No Human' Matters

Removing the operator changes the economics and the defence of an attack.

A traditional attack has a bottleneck: a human has to be in the loop, issuing commands, which limits how many targets one attacker can run and creates a server that defenders can find and cut off. An implant that reasons for itself needs neither. It can adapt on the machine, and there is no central command server whose disconnection stops it.

Talos frames this as a shift in 'effort displacement' — more of the attack chain running without a person involved. That is the same efficiency gain AI brings to legitimate work, pointed the other way.

The Important Caveats

This is where careful reading matters, because 'autonomous AI malware' is a phrase built to alarm.

Talos says there is no confirmation the implant has been deployed against real victims. It was analysed as a binary — a built piece of software — not caught mid-attack. The researchers connected artefacts in it to criminal-forum postings on payment-card fraud dating to 2025, which suggests a real author with criminal intent, but it stops short of a confirmed live campaign.

So the honest description is a working proof of concept with a plausible criminal origin, not a documented outbreak. That is significant, but it is not the same as an attack in progress, and the distinction should survive into any coverage.

There Is Also A Weakness In The Design

Delegating to commercial AI models is not a free win for the attacker, and this cuts in defenders' favour.

To consult those models, the malware has to reach their services, carry prompts, use API keys and speak their protocols — and every one of those is a fingerprint. Alongside the disclosure, Talos released an open-source tool that hunts for exactly these traces: embedded prompts, provider endpoints, API-key patterns and tell-tale AI syntax inside files. An attack that phones a chatbot for instructions leaves a trail an attack with a human operator does not.

What To Watch

Whether any confirmed CLOSEDQUORUM infections appear, which would move this from proof of concept to live threat. Whether the AI providers named can detect and cut off malware using their models, since the implant depends on their services to function. And whether defenders adopt tools that look for AI's fingerprints in code — because the same dependency that makes this malware autonomous is also what gives it away.