Cisco Talos Finds First Malware Run by Four AI Models

Cisco Talos has documented CLOSEDQUORUM, which it calls the first reported malware implant that hands its decision-making to commercial AI models in place of a human operator, a milestone the threat-intelligence group says arrived only 14 months after the first AI-assisted malware samples surfaced in July 2025.

Four commercial AI models take the attacker's seat at the keyboard

Conventional malware waits for instructions from a command-and-control server that a person operates. CLOSEDQUORUM replaces that operator with a committee: the implant queries models from DeepSeek, Alibaba's Qwen, Mistral and Google's Gemini, and carries out whichever action wins the vote from a short, fixed menu covering credential theft, code injection and persistence. Talos researcher Ryan Fetterman describes the result as "effort displacement," because the slowest part of an intrusion, a human deciding what to do next, drops out of the loop.

“It does not require continued commands from a human operator or tasking from a dedicated, attacker-operated C2 server; the complete dynamic operation is delegated to the AI.”

Ryan Fetterman, Cisco Talos, The Closed Quorum, September 22, 2026

Talos found a product for sale, with no confirmed victims yet

The version Talos analyzed is a distribution build with dummy API keys, which leaves it inert until a buyer compiles a customized copy with working credentials. Artifacts tie the developer to criminal-forum posts about carding going back to 2025, and Talos characterizes the offering as "credentials-as-a-service" in which the AI orchestration is the selling point.

The design also hands defenders clear openings. Model refusals, rate limits and timeouts stall it, and its reliance on commercial AI endpoints produces network traffic that security teams can observe and block. Talos advises watching for unexpected executables calling several AI providers at once, alongside the credential-access and persistence behaviors that endpoint tools already flag.

CAIRN gives defenders a way to hunt AI-integrated malware at scale

CLOSEDQUORUM is the first finding from CAIRN, the Cognitive Artifact Intelligence Research Network, which Talos released as open source the same day. CAIRN looks for the traces that AI integration leaves behind, such as prompt templates, provider API endpoints and keys, local model runtimes and jailbreak strings, using 24 acquisition filters, YARA rules and embedding-based clustering. Because it works on metadata, analysts never need to download or detonate a live sample. Talos cautions that the approach throws off frequent false positives from ordinary Python packaging, so every hit still needs a reverse engineer's confirmation.

The disclosure lands in a month when AI misuse has moved from theory into case files. Anthropic's September threat report detailed state actors using Claude to build software, and five US agencies warned in August that AI is already writing infrastructure exploits. For readers new to the mechanics, Santage's glossary entry on the AI agent explains how models are wired to take actions on their own.

Talos itself stops short of calling a turning point, writing that it is too soon to tell whether AI-integrated malware stays experimental. The more durable finding is economic. Once an AI committee can pick the next step of an intrusion, the scarce resource in cybercrime shifts from skilled operators to working API keys, and the commercial AI providers whose endpoints CLOSEDQUORUM calls become a new line of defense.