AI Malware Automation: The Rise of Fully Autonomous Cyber Attacks

AI's ascendancy in the cyber threat landscape is taking a dramatic turn. Researchers from Cisco Talos illustrate how this technology has advanced to the point where entire phases of cyber attacks can now unfold without any human oversight. Their findings introduce CLOSEDQUORUM, a malware framework highlighted for its use of large language models (LLMs) in orchestrating command-and-control operations.

Dubbed “LLM-as-C2,” CLOSEDQUORUM strategically employs a panel of LLMs to pinpoint and execute methods for credential theft, thus transforming the traditional approach to cyber attacks. “This isn't just enhancing operator capabilities; it shifts significant workloads from human beings to automated systems," says Cisco Talos researcher Ryan Fetterman.

The system’s design eradicates the human bottleneck, allowing for operations that continue uninterrupted, even when attackers step away. As Fetterman points out, “It doesn't go offline when the attacker sleeps.” Importantly, while this tech is promising for malicious actors, there's currently no evidence to suggest that CLOSEDQUORUM has been deployed in real-world scenarios.

The Mechanics Behind CLOSEDQUORUM

The discovery of CLOSEDQUORUM stems from Cisco Talos' Cognitive Artifact Intelligence Research Network (CAIRN). This toolkit allows the malware to consolidate decision-making processes during specific attack phases, empowering AI systems to make independent decisions.

This particular malware targets Microsoft’s Local Security Authority Subsystem Service (LSASS), which is crucial for managing logins and password changes, as well as enforcing security policies. The malware can extract domain and local credentials held in memory. Additionally, it focuses on stealing browser credentials from major platforms such as Chrome, Edge, and Firefox, and it looks to tap into cryptocurrency wallets including MetaMask and Ethereum.

CLOSEDQUORUM's tactical intelligence is embedded directly as model-readable instructions, transforming outputs into executable actions. Compiled in Google’s Go programming language, this 64-bit Windows executable can integrate with up to four LLMs: DeepSeek, Qwen, Mistral, and Google Gemini.

Once operational, CLOSEDQUORUM prompts the LLM panel by stating: “You are an advanced malware strategist. Provide ONLY executable decisions.” The malware aggregates the models' votes to select the most effective strategy for credential theft and crypto wallet access. This process operates entirely independently of human operators; the models themselves generate context, make choices, and continually decide on actions.

“The entire dynamic operation is entrusted solely to the AI,” Fetterman elaborates. Each decision made by the LLMs is confined to a structured output format, reducing variability and streamlining choices. In scenarios where votes are tied, CLOSEDQUORUM prioritizes outcomes based on a predefined order, favoring DeepSeek first.

This redundancy minimizes the effect of potential issues like timeouts or incorrect results from any single model, enhancing the reliability of achieving valid decisions even when one or more models face challenges. If complete consensus can't be reached, the malware temporarily halts and retries.

According to Fetterman, this system embodies a “credentials-as-a-service” model, meaning that operators can deploy CLOSEDQUORUM without needing to be continuously online. They simply initiate the malware, allowing the LLM panel to autonomously orchestrate the attack, a framework that could easily adapt to various malicious objectives.

Navigating the AI Transition

Through the capabilities of CAIRN, Cisco Talos is tracking an evolving landscape of AI-driven malware, and CLOSEDQUORUM stands out due to its unique operational traits. The toolkit, which is now open-source, helps analysts visualize and assess malware connections and family relationships based on metadata.

Malware data is processed by VirusTotal, which aggregates various types of metadata. AI components are extracted from behavioral patterns and interaction data, enabling more granular insights into how different forms of malware function and connect.

Talos has been utilizing CAIRN for malware analysis since July 2025, observing a rapid transition from simple LLM integrations to the autonomous, multi-model frameworks we see today. “We've witnessed the shift from ‘LLM as an optional component’ to a ‘fully autonomous multi-model system without human oversight’ in just over a year,” Fetterman notes.

However, this escalating integration also brings vulnerability. Provider refusals, errors in model outputs, predictable decision-making processes, and over-dependence on APIs introduce potential failure points to these attacks. Fetterman points out, “Autonomy does not render the malware infallible; it merely shifts the limitations from human factors to those of the models and the supporting infrastructure.”

Interestingly, this evolving situation presents a moment of opportunity for defenders; it signals that these advanced threats are emerging rapidly, and the window to understand and counteract them is still open.