AI malware just removed the human from the attack loop

Attackers using AI have greatly benefited when it comes to speed and scale, and now, says Cisco Talos, the technology has evolved to execute large portions of the attack chain entirely without human involvement.

Researchers at the threat intelligence group have identified what they call the first “LLM-as-C2” architecture that can fully automate the command-and-control (C2) chain. Dubbed CLOSEDQUORUM, the malware binary relies on a panel of large language model (LLM) judges to map and execute the optimal path to steal credentials.

“This is not merely augmenting what an operator can accomplish in a session, but transferring an entire phase of the attack from the operator to the system,” Cisco Talos security and threat researcher Ryan Fetterman explained in a blog post.

The benefits of speed and scale are compounded because the human-in-the-loop is no longer the bottleneck, he noted. Whereas humans have limits when it comes to working hours, attention span, and cognitive load, an AI system can continue when its operators are no longer watching. “It does not go offline when the attacker sleeps,” he said.

Cisco Talos emphasized, however, that there is not yet any confirmation of CLOSEDQUORUM deployment in the wild.

An LLM panel producing executable decisions

Discovered by Cisco Talos’ new Cognitive Artifact Intelligence Research Network (CAIRN) research toolkit, CLOSEDQUORUM collapses decision-making around a particular attack phase into constrained choices, giving AI the ability to act independently.

The malware specifically targets Microsoft’s Local Security Authority Subsystem Service (LSASS) credential dumping; LSASS processes logins and password changes, and enforces security policies. Dumping can extract domain and local credentials from memory.

CLOSEDQUORUM also executes browser credential theft, particularly targeting saved passwords in Chrome, Edge, and Firefox, and seeks to extract crypto wallets including MetaMask, Ethereum, and Exodus.

Tactical knowledge is directly encoded as model-readable context, and subsequent model outputs are automatically converted into executables. Compiled in Google’s Go programming language, the 64-bit Windows executable supports up to four LLM integrations: DeepSeek, Qwen, Mistral, and Google Gemini.

After deployment, CLOSEDQUORUM queries the panel of models in sequence with the system prompt: ‘You are an advanced malware strategist. Provide ONLY executable decisions.’ CLOSEDQUORUM then tallies their independent verdicts and acts based on its goal of harvesting user credentials and crypto wallets.

The session is closed; no humans are admitted. Models receive context, choose capabilities, provide execution parameters, and continuously make decisions without the need for continued human commands or tasking from dedicated, attacker-operated C2 servers.

“The complete dynamic operation is delegated to the AI,” Fetterman explained. The LLMs vote on next actions, and the action with the most votes is automatically selected. Importantly, the model panel is not free to respond in any format; it is constrained to using a defined JSON structure with a decision field mapping to a specific capability. Anything else is discarded.

“This design reduces the model’s output to a constrained set of executable choices,” Fetterman explained.

In the event of a tie, the malware decides based on model preference: first DeepSeek, then Qwen, Mistral, and, finally, Gemini. “The tie behavior is fully deterministic and biased toward DeepSeek,” Fetterman noted.

The multi-LLM structure reduces impacts from any individual refusals, timeouts, or malformed responses. Thus, “it increases the likelihood of obtaining a valid decision, but does not guarantee one,” Fetterman explained. The quorum can reach a decision even when one or more member is unresponsive or hits a guardrail. If all models happen to fail, this serves as a consensus, causing the loop to sleep and retry rather than defaulting to action.

Fetterman called CLOSEDQUORUM a credentials-as-a-service model, and noted that a human operator who acquires the malware does not need to be online to run their campaign. “They deploy the binary, and the LLM panel runs the attack,” he said. “This type of scaffolding approach could easily be translated and applied to other adversary objectives.”

A ‘fleeting window’ of AI transition

Cisco Talos discovered CLOSEDQUORUM with its new CAIRN open-source research toolkit for hunting, classifying, and tracking AI-integrated malware. Released today, CAIRN is “metadata-first,” and can craft structured graphs of artifact relationships to help human defenders identify related malware families and infrastructure.

Malware samples are sent to VirusTotal, which extracts and indexes static, dynamic, reputation, and behavioral metadata. AI-related artifacts are surfaced from content, behavior, URLs, labels, and resource metadata, and 12 targeted filters capture different classes of artifacts (APIs, prompts, frameworks, tooling, runtimes).

Findings are classified by artifact, behavioral context, and operational families; text is studied for semantic similarities and relationships; and VirusTotal maps infrastructure, variants, and campaign connections.

Talos has used CAIRN to hunt malware development since July 2025, and the researchers have found that the autonomous framework is changing rapidly. “The progression from ‘LLM as optional feature’ to ‘fully autonomous multi-model consensus orchestrator with no human operator’ filled in within a single calendar year,” Fetterman noted.

Scripts have been compiled into malware, and tradecraft is being taught and spread as CLOSEDQUORUM and similar techniques reach threat actors with no connection to the original malware sample. “We may be in a fleeting window to observe AI transition,” Fetterman noted. “AI integration is becoming commonplace in all software.”

CLOSEDQUORUM in particular has distinct hallmarks: AI-provider API traffic originating from unexpected Windows executables; structured prompts containing context or capability language; repeated execution at randomized five minute to 15 minute intervals; and Discord webhook communication from the same process or host. Intrusions are achievable with currently available models and “ordinary API access,” Fetterman noted.

Still, the malware technique introduces weaknesses too: Provider refusals, malformed outputs, predictable tie-breaks, constrained schemas, and dependence on commercial APIs can all lead to attack failure.

“Autonomy does not make the implant infallible; it exchanges some human limitations for model and infrastructure limitations,” Fetterman said. “The advantage for defenders is that this progression is still only beginning.”