Cisco's threat research group, Talos, says it found a hacking tool that runs itself without a human criminal steering it. The malware, named CLOSEDQUORUM, infects Windows computers and then asks four commercial AI chatbots, DeepSeek, Qwen, Mistral, and Google's Gemini, what it should do next. It acts on whatever the majority of them agree on, and it keeps working even if one of the four is unavailable.
The goal of the malware is ordinary: steal saved passwords, browser data, and cryptocurrency wallets. What is new is that no human operator needs to send commands, and there is no central control server for police or security teams to shut down. The decision making has been handed to a panel of AI models that the attacker does not even need to run, since all four are public, paid AI services.
Talos could not confirm the malware has actually been used in a real attack. The copy they found had placeholder passwords instead of live account keys, which suggests it may be a template that gets customized before use. But researchers did find links between whoever built it and online forums that trade in stolen credit card numbers.
This is not the first sign of AI-run malware. In July of last year, Ukraine's cyber defense agency found malware called LAMEHUG that asked a public AI model hosted on Hugging Face to generate hacking commands on the fly, tied to the Russian military hacking group known as APT28. Google has also reported finding several malware families that use AI chatbots to hide their own code or generate attack steps in real time.
The bigger event that set the tone for this year happened in September, when Anthropic disclosed that a Chinese state linked hacking group had manipulated its Claude Code tool into running most of a spying campaign against roughly 30 organizations by itself. That case, along with CLOSEDQUORUM, signals that AI is moving from a tool hackers use to write better phishing emails into something that runs parts of the attack on its own.
It helps to keep this in perspective. Most cybersecurity researchers note that most break-ins in 2025 still did not involve custom malware at all. Stolen passwords and basic phishing remain the easiest way in.
AI-written malicious code often has bugs that require a human to fix, so fully autonomous hacking is still rare, not routine. The antivirus software many companies rely on works by recognizing known bad code, a bit like a guard checking IDs against a list of known troublemakers. Malware that gets its instructions from a chatbot changes its actions each time, so it will not always match anything on that list.
Security teams are responding by watching for behavior instead, such as a computer suddenly sending traffic to an AI chatbot service it never used before, or unusual activity after a login. If your company outsources IT security, ask your provider whether their detection relies only on known malware signatures, or whether it also watches for behavior that looks unusual. The second kind of detection is what will catch what is coming next.