This Malware Doesn’t Wait for Hackers—It Asks AI Models What to Do Next

A new Windows malware called CLOSEDQUORUM uses AI models to decide its next actions, such as stealing data or maintaining access. The malware queries AI services like DeepSeek, Qwen, Mistral, and Gemini for decisions, marking a shift in attack methods. Cisco Talos identified the implant, noting it lacks a working handler for network movement. Defenders should watch for unusual AI service contacts and Discord webhook communications. The malware highlights a trend of attackers delegating tactical choices to software.