Cybersecurity researchers have discovered malware with fully autonomous command-and-control infrastructure that consults up to four large language models to decide its next moves, according to a framework published Monday by Cisco Talos. The hacking tool, dubbed CLOSEDQUORUM, polls DeepSeek, Qwen, Mistral, and Google Gemini to develop a consensus on its actions, creating a system with no mechanism for human input. The discovery came through a new open-source framework called Cognitive Artifact Intelligence Research Network, or CAIRN, designed to classify and analyze malware that integrates AI components.
CAIRN identifies AI-integration characteristics from metadata and assigns each malware sample what amounts to a unique ID, then analyzes artifacts in the context of the entire library to reveal trends and connections. Security researcher Ryan Fetterman, who led CAIRN's development, initially found only about nine documented examples of AI-integrated malware families when he began his retrospective last summer, some of which were research proofs of concept. After working with CAIRN for several months, he discovered roughly 20 additional examples of AI-integrated malware. The CLOSEDQUORUM malware operates on Windows systems and is designed to steal login credentials and cryptocurrency, with some connections to cybercriminal forums about credit card fraud dating back to 2025, though researchers couldn't confirm who developed it or whether it's been deployed in real attacks.
"The core idea is that AI integration has these vestiges, like fingerprints, that are left behind," Fetterman says in the report. "That gives us a signal that we can use to track these samples, classify them, and look at what's happening." The framework takes its name from cairns, the stone stacks hikers build on trails to mark paths or highlight specific spots. The researchers note that even if one AI service becomes unavailable, CLOSEDQUORUM continues polling the others, building in enough redundancy to keep the system completely closed. Fetterman had expected a major surge in AI-enabled malware after Ukrainian cybersecurity unit CERT-UA warned in July 2025 about a phishing campaign using malware called LAMEHUG, which communicated with an LLM through a Hugging Face API for commands.
The shift from experimental to operational represents the key change attackers are making with AI tools, according to Matt Olney, senior director of threat intelligence at Cisco Talos. While everyone initially viewed AI as a productivity tool for both legitimate and malicious purposes, it's now becoming operationalized in ways that let attackers run more campaigns, target more systems, and handle different computers because they have an intelligent backend that can ask questions and provide responses. The landscape is considerably more complex and diverse than public reports have indicated, Fetterman notes, providing a valuable early signal of what's coming. The framework is being released as open source with the hope that wide adoption will help the defensive community track these emerging threats as they become mainstream. Organizations that integrate threat intelligence into their security posture may find themselves better positioned to detect these hybrid attacks before traditional signatures catch up, though the arms race between autonomous offensive and defensive AI tooling will likely test existing incident response protocols in unexpected ways.