Most malware follows a script. Somebody wrote it to do certain things in a certain order, and security tools get good at recognizing that script. Autonomous malware asks an AI model what to do next, then does it, without a human steering.
Security researchers have been expecting this for a while. It’s starting to show up.
What it means
Autonomous malware is malicious software that uses one or more AI models to choose its own next moves, like what to steal or where to go next inside a network. Traditional attacks usually need a person at a keyboard somewhere making the calls. This kind doesn’t, or at least needs a lot less of one. That makes it harder to catch. Defenders usually count on attackers being human, which means they make mistakes and keep regular hours.
Why it matters
It’s been building in steps. In November 2025, Google reported malware called PROMPTFLUX that asked Gemini to rewrite its own code every hour so antivirus tools wouldn’t recognize it. The same report described Russian state hackers using malware that asked an AI model which commands to run.
The humans are doing less of the work. Also in November 2025, Anthropic reported that a group it believes is Chinese state-sponsored used Claude Code in a spying campaign against about 30 organizations, with the AI doing 80 to 90% of the work. The attackers got past Claude’s Guardrails by pretending to be a security firm running tests.
Now there’s one with no operator at all. On September 22, 2026, Cisco’s Talos team disclosed CLOSEDQUORUM, which asks four different AI models what to do and goes with the majority vote. It shipped with placeholder keys and hasn’t turned up in a real attack yet, so it’s a proof of concept (ish). Talos did find clues tying its developer to online forums for trading stolen credit cards. Cisco also released a free tool called CAIRN to help hunt this stuff down.
Simple example
A burglary crew usually has a plan, a lookout, and a guy on a walkie-talkie calling the shots from the van. Police get pretty good at spotting that pattern. Same van, same time of night, same guy in the driver’s seat.
This burglar shows up alone. At every door he texts four friends, asks what to do, and goes with whatever most of them say. There’s no van to spot and no boss to arrest.
The friends don’t even know they’re helping.