Cisco Talos found malware that consults multiple large language models to decide what to do without a human operator issuing each instruction. The architecture is real; its prevalence in successful criminal campaigns is still unclear.
Cisco Talos researchers have found a Windows malware family, CLOSEDQUORUM, that uses several large language models as part of its command system. The malware can query services including DeepSeek, Qwen, Mistral and Gemini and use their responses to decide subsequent actions without a human attacker directing every step. Talos found the sample while developing CAIRN, a framework for identifying AI-integrated malware. WIRED reported that the work has surfaced around 20 additional examples of malware with AI components.
This is a technical threshold rather than proof of a dominant new cybercrime model. Researchers have not publicly established who built CLOSEDQUORUM or shown that it is already compromising enterprise networks at broad scale.
What has changed is the command architecture. Conventional malware usually depends on attacker-controlled infrastructure that defenders can discover, block or seize. AI-enabled malware can push more decision-making into the malicious code itself or into calls to general-purpose models, reducing the need for continuous human direction and making behavior less predictable from one execution to the next.
The security implication is broader than the specific family. Enterprises are already giving legitimate agents credentials, APIs and execution rights so they can act across systems. Malware that acquires similar privileges can hide inside a growing population of automated processes. Identity, least-privilege controls, process behavior and tool authorization become more important as the line between "software that acts" and "agent" blurs.
A separate BigCommerce incident shows why causal discipline matters. BigCommerce said credentials linked to the third-party Ribon application were compromised and malicious scripts were injected into a small number of storefronts between September 13 and 17. There is no public evidence connecting that breach to CLOSEDQUORUM or to autonomous AI malware.
The useful conclusion is narrower and more consequential. Autonomous command logic has appeared in real malware code and associated infrastructure. The next question is epidemiological: whether attackers can use these systems repeatedly, reliably and at scale. Security teams have enough evidence to tighten agent identities and execution rights now; investors should wait for prevalence data before treating autonomous malware as an established criminal operating model.