Researchers document Windows malware that lets AI models choose attack actions

Cisco Talos has documented a Windows malware sample called CLOSEDQUORUM that asks up to four AI models to choose its next action after a system is compromised, Gadget Review reports. The implant sends information about the host to the models and executes the action that wins a plurality vote. Its choices are limited to attack capabilities already built into the malware, including targeting credentials, browser passwords and cryptocurrency wallet data. The design does not require a human operator to issue each subsequent command. Talos has identified no confirmed victims or deployment in an active campaign.