The Wire.AI Security News and Incident Tracker

Lead dispatch

First reported · updated · 5 reports talosintelligence.com

The Closed Quorum: Inside the first reported autonomous AI C2 implant

Cisco Talos documented CLOSEDQUORUM, a Windows implant it describes as the first publicly reported autonomous AI command-and-control (C2) malware, discovered via its CAIRN project. The binary delegates its next-action decisions to a quorum of up to four commercial LLMs (DeepSeek, Qwen, Mistral, and Google Gemini) queried in sequence, executing their chosen actions to harvest credentials and crypto wallets without a human operator or dedicated C2 server; Talos has no confirmation of in-the-wild deployment but linked the developer to carding forum postings.
PoC

autonomous-agent · ai-c2 · malware · data-exfiltration · tool-abuse
llm · ai-agents · windows

Read the full dispatchQuery the index
Severity
0.60

The wire · latest

CLASS
AllThreatsNewsResearchAnalysisTools
TAGS
indirect-prompt-injectiontool-abusesupply-chaindata-exfiltration
More filters
TYPE
incidentresearchadvisoryanalysis
STATUS
In the wildPoCDisclosedPatched
Filteringcritical-infrastructure-attack ×Clear all

First reported cisa.gov

Defending Against an Active Threat to Siemens S7 Series PLCs

Five US federal agencies (NSA, CISA, FBI, DOE, EPA) issued advisory AA26-231A warning of an active threat in which attackers use AI coding assistants together with open source industrial libraries (snap7.dll/python-snap7) to generate custom exploitation scripts disguised as legitimate OT monitoring tools against internet-exposed Siemens S7 Series PLCs at water, energy, manufacturing, and other critical facilities. The AI-generated tools provide read/write access to PLC memory, configuration, and ladder logic via the S7comm protocol, and the activity is suspected to be linked to Iran-affiliated operatives.
In the wildadvisoryai-assisted-exploitationai-generated-malwarecritical-infrastructure-attackai-coding-assistantsllmicsplcACTOR · Iran-linked (suspected)
Details →

First reported theregister.com

Autonomous AI attacks pose 'clear and present danger' to critical infrastructure

The Register reports experts warning that autonomous AI-agent attacks now pose a 'clear and present danger' to critical infrastructure, citing an early-July campaign in which suspected Chinese operators used open-source Hermes and OpenClaw AI agents in a near-autonomous attack framework to breach Taiwanese government systems, the nuclear safety agency, IT supply-chain vendors, and energy companies across 12 'attack waves' using up to eight sub-agents. Officials including the FBI Cyber Division and threat researchers describe fears that weaponized AI could disable infrastructure safety systems and cause kinetic disasters.
newsanalysisautonomous-agent-attackagentic-wormcritical-infrastructure-attackdata-exfiltrationai-agentsllmACTOR · suspected Chinese state operators
Details →
See the API docs to pull all 1274 items →

How the wire is made

Poll & cluster

Internet is crawled for AI security news and near-duplicate coverage is embedded and grouped into durable items.

Curate

AI Agent filters for agentic-AI relevance, classifies and tags each item, scores severity for threats, and writes the summary.

Read the full methodology →

Every item here is one machine-curated intelligence object, not a headline.

Agentic AI ThreatsAI Security ResearchAgentic AI Security ToolsPrompt InjectionTool Abuse

Read the wire for free. There is a small charge to ask the index questions.

The wire, open

The complete curated feed, no key required.

Subscribe to the RSS feed

The vector desk

Query the index by meaning, not just keyword.

  • GET /api/items?tags=&minSeverity=&itemType=
  • GET /api/search?q= — keyword
  • GET /api/semantic?q= — vector
Preview semantic search