Malware is starting to make some of its own decisions.
Cisco Talos researchers have identified a Windows implant called CLOSEDQUORUM that can ask several large language models what to do next, tally their answers and then carry out the winning action without waiting for new instructions from a human operator.
The setup marks a change from the way most malicious software works. Conventional malware generally follows code written in advance or takes commands from an attacker-controlled server. CLOSEDQUORUM instead uses commercial AI services as part of its decision loop, giving the models information about the infected computer and asking them to choose from a limited menu of actions.
The system can query DeepSeek, Qwen, Mistral and Google Gemini. Each model returns a structured answer, and the malware counts the votes. The action with the most support wins. If the models tie, the software uses a fixed order that gives DeepSeek first priority, followed by Qwen, Mistral and Gemini, according to Talos.
The choices are not open-ended. Talos found that the models are asked to select among defined capabilities such as stealing credentials, establishing persistence on a machine or injecting code into another process. The malware can gather information about the computer, including its Windows version, processor count and whether the user has administrator privileges, and feed that context into the prompts it sends to the models.
If the models choose to steal data, CLOSEDQUORUM can target Windows credentials, passwords stored in Chrome, Edge and Firefox, and cryptocurrency wallets including MetaMask and Exodus. Talos said stolen material can be encrypted and sent to an operator through Discord.
No human required
What makes the design unusual is not any single hacking technique. Most of the individual capabilities are familiar to security researchers. The difference is where the tactical decision gets made.
Traditional command-and-control systems give an attacker a way to tell compromised machines what to do. CLOSEDQUORUM can keep making some of those choices after it has been deployed. Talos described the change as “effort displacement,” in which an attacker hands a bounded part of an operation to software rather than merely using AI to work faster.
“It does not go offline when the attacker sleeps.”
Cisco Talos
That distinction matters because AI has already made it easier to produce phishing messages, write code and analyze potential targets. Autonomous decision-making could let attackers run more operations at once while spending less time supervising each one.
“Now what we’re seeing is that it’s becoming operationalized,” Matt Olney, senior director of threat intelligence at Cisco Talos, told WIRED.
An early warning
There are important limits to the finding. Talos has not confirmed that CLOSEDQUORUM has been used in a real-world attack. The publicly available version researchers examined contains placeholder API keys and a dummy Discord address, meaning it cannot operate as distributed. Talos found evidence suggesting that customized builds could be created with working credentials, but the researchers did not observe a complete attack using the system.
Talos also could not identify the malware’s developer with certainty. Researchers said artifacts connected to the software led to posts on criminal forums related to credit-card fraud dating to 2025.
The implant surfaced as Talos researchers were developing CAIRN, an open-source framework designed to identify and classify malware that incorporates AI. Ryan Fetterman, the Talos researcher leading the project, told WIRED that the work has turned up about 20 additional examples of AI-integrated malware beyond the small number of families that had already been publicly documented.
For defenders, CLOSEDQUORUM also creates some unusual signals. A Windows program contacting several AI providers in quick succession is not necessarily malicious. But the same program contacting multiple model APIs while accessing Windows credential memory, injecting code into processes and communicating with Discord would be far harder to explain as ordinary software.
That may give defenders a window while this kind of malware remains relatively crude. Commercial AI services can refuse requests, hit rate limits or return malformed answers. CLOSEDQUORUM’s own decision menu is narrow, and its predictable voting system creates additional weaknesses.
The larger point is that autonomous cyberattacks no longer require a hypothetical future model. CLOSEDQUORUM shows that today’s commercially available models can already be wired into malware as a tactical decision layer. The system Talos found may be an early example, but the architecture is straightforward enough to copy.
AI Safety Watch 