A New Tool Found Malware That’s Guided by an AI Hive Mind—No Humans in Sight
wired ·
Cisco Talos researchers have developed CAIRN, an open-source framework designed to identify and classify malware that integrates AI chatbots by detecting unique digital fingerprints left behind by these technologies. Using this tool, they uncovered CLOSEDQUORUM, a Windows-based hacking tool that operates with full autonomy through an AI hive mind without human intervention. This malware polls multiple large language models, including DeepSeek, Qwen, Mistral, and Google Gemini, to reach a consensus on its next actions within target systems. The system is designed for redundancy, continuing to function even if one AI service becomes unavailable, thereby eliminating the need for human command-and-control infrastructure. Although initial reports of AI-enabled malware were sparse, CAIRN has helped identify approximately twenty additional examples, suggesting the landscape is more complex than previously thought. The CLOSEDQUORUM tool appears linked to cybercriminal forums discussing credit card fraud and aims to steal login credentials and cryptocurrency. While developers remain unidentified and real-world usage unconfirmed, the discovery highlights how attackers are operationalizing AI to run more extensive and intelligent campaigns.
wired