Cisco Discloses First Known Fully Autonomous AI-Directed Malware

Cisco's Talos security research team disclosed a new Windows malware strain, nicknamed CLOSEDQUORUM, that makes its own attack decisions in real time by polling four commercial AI models and acting on whichever action gets the most votes — with no human attacker directing it moment-to-moment.

Key points:

• The malware queries DeepSeek, Qwen, Mistral, and Google Gemini simultaneously for each decision, tallies their responses, and executes the winning choice from a fixed menu: stealing credentials, injecting itself into other processes, or persisting on the infected machine.

• Talos said the malware "does not require continued commands from a human operator or tasking from a dedicated, attacker-operated server" — a structural shift from traditional malware, which still needs a human to send new instructions as a break-in unfolds.

• Earlier malware is like a burglar taking orders over a phone from an accomplice; this malware is like a burglar deciding what to do next entirely on its own, by taking a quick vote among four advisors.

• Talos released an open-source detection toolkit, CAIRN, including rules that can spot the malware's distinctive patterns — hardcoded prompts, specific function names, and its use of Discord as a channel to send stolen data back.

• None of the four AI companies were shown to have built or endorsed this use — the malware simply calls their public APIs like any other customer would.

Why It Matters: This isn't a hypothetical warning — it's working malware found in the wild that removes the human decision-maker from an active attack entirely, exactly the unsupervised-agent risk that kill-switch requirements are meant to address.