Researchers have identified the first malware architecture that removes humans entirely from the command-and-control chain, using multiple large language models to decide and execute attack steps without any operator involvement. Cisco Talos discovered the malware, named CLOSEDQUORUM, which deploys a panel of AI judges to autonomously steal credentials and cryptocurrency wallets. The threat intelligence group has not yet confirmed any real-world deployment of the malware, but called it a major evolution in how artificial intelligence can be weaponized for cyberattacks.

CLOSEDQUORUM specifically hunts credentials from Microsoft's Local Security Authority Subsystem Service, which handles logins and password changes, and targets saved passwords in Chrome, Edge, and Firefox browsers. The 64-bit Windows executable, written in Google's Go language, integrates up to four LLMs: DeepSeek, Qwen, Mistral, and Google Gemini. After launch, the malware queries each model in turn with the system prompt instructing them to act as an advanced malware strategist providing only executable decisions. The models vote on next actions using a defined JSON structure, and the option receiving the most votes executes automatically. When votes tie, the system defaults to DeepSeek first, then follows a fixed preference order through Qwen, Mistral, and finally Gemini. If all models fail to respond, the malware pauses and retries rather than taking default action.

According to Cisco Talos researcher Ryan Fetterman, "This is not merely augmenting what an operator can accomplish in a session, but transferring an entire phase of the attack from the operator to the system." The multi-model structure reduces the impact of individual refusals, timeouts, or malformed responses, increasing the odds of obtaining a valid decision without guaranteeing one. Fetterman characterized the malware as a credentials-as-a-service model where human operators don't need to remain online after deployment. The report notes that the complete transition from LLM as optional feature to fully autonomous multi-model consensus orchestrator with no human operator occurred within a single calendar year.

The autonomy creates new vulnerabilities defenders can exploit, the report finds. Provider refusals, malformed outputs, predictable tie-breaking behavior, constrained schemas, and reliance on commercial APIs all introduce potential failure points absent in traditional human-controlled attacks. Cisco Talos released an open-source toolkit called CAIRN today to hunt AI-integrated malware by analyzing metadata, crafting relationship graphs, and mapping infrastructure connections through VirusTotal. Defenders can watch for hallmarks including AI-provider API traffic from unexpected Windows executables, structured prompts with capability language, repeated execution at randomized five-to-15-minute intervals, and Discord webhook communication from the same process. Fetterman noted that autonomy trades human limitations for model and infrastructure limitations, and that this progression is still only beginning, giving defenders time to adapt. The technology landscape is shifting rapidly as techniques spread to threat actors with no connection to original samples, potentially opening a brief window to observe and understand AI's transition from augmentation tool to independent attack operator. Organizations should recognize that competitive pressure to integrate AI capabilities may inadvertently lower barriers for adversaries exploring the same automation, requiring security strategies that account for threats operating continuously without human supervision.