New malware uses AI chatbots to decide its own next move
Cisco researchers found Windows malware that polls four AI models to vote on whether to steal data, hide, or spread — no human hacker required.
What happened: Cisco Talos researchers discovered a new Windows malware strain called ClosedQuorum that uses four commercial AI models ">Google Gemini, DeepSeek, Qwen, and Mistral, to decide what to do once it has infected a computer. Instead of waiting for instructions from a human hacker, the malware sends details about the infected machine to all four models, which each vote on the best next move. If the vote ties, DeepSeek gets the deciding say.
Why it matters: Most malware needs a human operator to review what it found and type in the next command, which slows attacks down and creates chances for defenders to notice. ClosedQuorum removes that step. Talos calls it the first publicly documented Windows malware to hand tactical attack decisions to a panel of AI models, which the researchers say could let attacks move faster and scale to more victims with less effort from the criminals behind them.
How it works, plainly: The AI panel can only choose from a fixed menu of actions: stealing saved passwords and cryptocurrency wallets, injecting malicious code into other programs, or setting up ways to survive a reboot. A fourth option, spreading to other computers on a network, is listed but doesn't actually work in the version researchers examined. Whatever gets stolen is automatically sent to the attackers through a Discord messaging channel, so the entire operation after initial infection can run with no person watching.
The rollout: Talos found ClosedQuorum using a new open-source tracking tool it built specifically to catch AI-powered malware, and says the sample it studied was fairly unsophisticated and had placeholder credentials, suggesting it may be a test rather than a finished weapon. Researchers linked artifacts in the code to a developer active on criminal forums since 2025, but found no confirmed evidence it has been used against real victims yet.