AI Malware Now Runs Attacks Without Human Operators

Autonomous AI malware eliminates the human bottleneck

Cybersecurity researchers have identified malware that removes humans from the attack loop entirely, using artificial intelligence to make tactical decisions and execute credential theft operations without operator involvement.

Cisco Talos discovered CLOSEDQUORUM, what they describe as the first "LLM-as-C2" architecture capable of fully automating the command-and-control chain. The malware queries a panel of large language models, tallies their votes, and automatically executes the winning action—no attacker commands required.

"This is not merely augmenting what an operator can accomplish in a session, but transferring an entire phase of the attack from the operator to the system," Cisco Talos researcher Ryan Fetterman wrote. The malware continues operating even when its human operators are offline or asleep.

Cisco Talos has not yet confirmed CLOSEDQUORUM deployment in actual attacks.

How the LLM voting system works

COMPILED in Google's Go programming language, CLOSEDQUORUM targets Windows systems and integrates up to four LLM services: DeepSeek, Qwen, Mistral, and Google Gemini. After deployment, it queries each model in sequence with the prompt: "You are an advanced malware strategist. Provide ONLY executable decisions."

The malware focuses on three objectives: dumping credentials from Microsoft's Local Security Authority Subsystem Service (LSASS), stealing saved passwords from Chrome, Edge, and Firefox browsers, and extracting cryptocurrency wallets including MetaMask, Ethereum, and Exodus.

Each LLM receives system context and votes on the next action. The malware tallies votes and automatically executes the majority choice. Models cannot respond in free text—outputs must conform to a defined JSON structure with a decision field mapping to specific capabilities. Anything else gets discarded.

In case of a tie, CLOSEDQUORUM follows a deterministic hierarchy: DeepSeek first, then Qwen, Mistral, and finally Gemini. The multi-model approach provides resilience against individual model failures, refusals, or timeouts. If all models fail simultaneously, the malware sleeps and retries rather than taking default action.

Why it matters

CLOSEDQUORUM represents a fundamental shift in attack economics. Traditional malware requires continuous human oversight, limiting campaign scale to operator availability and attention span. Autonomous AI malware eliminates this constraint, enabling attacks that run continuously across multiple targets without additional labor costs. For defenders, this means adversaries can achieve greater scale with fewer skilled operators, while the attack surface expands to include AI provider APIs and model behavior patterns as new detection opportunities.

Detection opportunities and vulnerabilities

The autonomous approach introduces distinct detection signatures: AI provider API traffic originating from unexpected Windows executables, structured prompts containing tactical language, repeated execution at randomized five-to-15-minute intervals, and Discord webhook communications from the same process.

The technique also creates new failure points. Provider refusals, malformed model outputs, predictable tie-breaking behavior, constrained response schemas, and dependence on commercial APIs all represent potential weaknesses. "Autonomy does not make the implant infallible; it exchanges some human limitations for model and infrastructure limitations," Fetterman noted.

Cisco Talos discovered CLOSEDQUORUM using CAIRN, a new open-source research toolkit released for hunting AI-integrated malware. The toolkit analyzes samples through VirusTotal, extracting metadata and mapping infrastructure connections to identify related malware families.

Fetterman observed that autonomous frameworks evolved rapidly: "The progression from 'LLM as optional feature' to 'fully autonomous multi-model consensus orchestrator with no human operator' filled in within a single calendar year."

These details were first reported by Cisco Talos.