Cisco Talos Discovers Autonomous AI Malware Using LLM Decision Panel

Researchers at Cisco Talos have identified a novel malware architecture that uses a panel of large language models (LLMs) to automate the command-and-control (C2) phase of an attack entirely without human involvement.

The malware, named CLOSEDQUORUM, represents a shift from AI-augmented attacks to fully autonomous operations. By delegating decision-making to a “quorum” of AI models, the malware can execute complex attack chains without waiting for commands from a human operator.

Autonomous Decision-Making via LLM Panel

CLOSEDQUORUM operates by querying multiple LLMs in sequence to determine the optimal path for an intrusion. The system supports integrations with DeepSeek, Qwen, Mistral, and Google Gemini. To ensure the AI’s decisions are actionable, the malware constrains the models to respond using a specific JSON structure, which allows the outputs to be automatically converted into executable commands.

In the event of a disagreement between models, the malware follows a deterministic tie-breaking logic, prioritising responses from DeepSeek. This multi-model approach is designed to increase the success rate of the attack, ensuring that if one model hits a safety guardrail or fails to respond, the others can still reach a consensus.

Ryan Fetterman, a security and threat researcher at Cisco Talos, noted that this “credentials-as-a-service” model means a human attacker does not need to be online to run a campaign; they simply deploy the binary and let the LLM panel manage the attack. Because the system does not require a human in the loop, it avoids the limitations of human working hours and cognitive load.

Targeting Credentials and Crypto Wallets

The malware is a 64-bit Windows executable compiled in the Go programming language. It specifically targets high-value data, including:

• Microsoft LSASS: Attempting to dump domain and local credentials from the Local Security Authority Subsystem Service (LSASS), which handles logins and security policies.
• Browser Data: Extracting saved passwords from Google Chrome, Microsoft Edge, and Mozilla Firefox.
• Cryptocurrency Assets: Searching for and extracting wallets such as MetaMask, Ethereum, and Exodus.

Rapid Evolution of AI-Integrated Malware

The discovery was made using the Cognitive Artifact Intelligence Research Network (CAIRN), a new open-source research toolkit released by Cisco Talos to hunt and classify AI-integrated malware. CAIRN identifies AI-related artefacts by analysing metadata, behaviour, and resource labels.

According to Fetterman, the transition from AI being an optional feature to a fully autonomous orchestrator has occurred within a single calendar year. While the autonomy provides attackers with unprecedented speed and scale, it also introduces new vulnerabilities. The malware’s reliance on commercial APIs means it is susceptible to provider refusals, malformed outputs, and infrastructure limitations.

Cisco Talos emphasized that there is currently no confirmed evidence of CLOSEDQUORUM being deployed in the wild.