Blog

Cisco Talos researchers say they have identified Windows malware that plots its next moves by polling up to four large language models and taking orders from that hive mind — with no human command channel — WIRED reported Tuesday.

Dubbed CLOSEDQUORUM, the tool checks with DeepSeek, Qwen, Mistral, and Google Gemini to build a consensus on what to do inside a target system. If one AI service is down, it still polls the others, creating redundancy so the system stays closed. Talos linked the sample to cybercriminal forum chatter about credit-card fraud going back to 2025; it is designed to steal login credentials and cryptocurrency. Researchers could not confirm who built it or whether it has been used in real-world attacks.

The find came via CAIRN — Cognitive Artifact Intelligence Research Network — an open-source framework Talos shared Monday to fingerprint and classify AI-integrated malware. Lead researcher Ryan Fetterman said publicly named AI malware families were still scarce a year after Ukraine’s CERT-UA warned about LAMEHUG, but CAIRN has since surfaced about 20 additional examples. “Now what we’re seeing is that it’s becoming operationalized,” said Matt Olney, senior director of threat intelligence at Cisco Talos.

Sources: WIRED

Iran can reopen the Strait of Hormuz within seven days if the United States eases military pressure and lifts its blockade on Iranian ports, a senior Iranian official told Reuters on Tuesday from New York.

“The US needs to announce that it wants to resolve the issue diplomatically, make that official, and then agree on a timeline for how the process will move forward,” the official said, adding that Iran’s UN General Assembly delegation has full authority to revive diplomacy. Tehran’s proposal was delivered to Washington via mediators on September 16, the official said; details of an end to hostilities could be discussed in New York through mediators.

Iran’s President Masoud Pezeshkian left Tehran for New York on Tuesday morning but will not meet President Donald Trump at UN headquarters, the official told Reuters. On Sunday, Iran’s military central command said it had been informed the U.S. was preparing to restart military operations with regional support and warned of retaliation “without limitations and considerations.” “The UN General Assembly is a golden opportunity for the US to return to diplomacy,” the official said.

Sources: Reuters

Ukrainian President Volodymyr Zelenskyy is due to meet U.S. President Donald Trump at the United Nations in New York on Tuesday, where Kyiv will push for an energy truce with Russia as world leaders gather for the General Assembly, Reuters reported.

The diplomacy lands after overnight Russian missile and drone attacks hit industrial sites and critical energy infrastructure across several Ukrainian regions, killing at least three people and knocking out power to nearly 100,000 residents, Ukrainian officials told Al Jazeera and Reuters. Ukraine’s air force said Moscow’s barrage involved 212 drones, four cruise missiles, and other munitions. Ukrainian drones also hit Russia’s Samara region overnight, killing one and injuring four according to the local governor.

Zelenskyy wrote that a “drone deal” was ready to strengthen air defense and funding, and that about 20 meetings were planned — including with Trump, European leaders, and U.S. lawmakers. After meeting Trump on Monday, French President Emmanuel Macron said the two countries agreed to work toward a moratorium on strikes targeting energy networks and civilian infrastructure in Ukraine. Trump’s Tuesday UN schedule includes Zelenskyy among at least 11 leader meetings after a morning General Assembly address, Reuters said.

Sources: Reuters (Zelenskiy–Trump); Reuters (UN schedule); Al Jazeera

Russia’s ruling United Russia party locked a record supermajority in the State Duma after wartime parliamentary elections, with about 57.83% of the vote and 355 of 450 seats once nearly all ballots were counted, Reuters and The Guardian reported Monday. That tops the party’s prior 2016 high of 343 seats and is up from 49.8% in 2021.

Officials said 49 deputies elected to the new parliament have taken part in the war against Ukraine — the first Duma vote since Vladimir Putin’s 2022 full-scale invasion. Kremlin spokesman Dmitry Peskov cast the result as proof of “the highest level of consolidation within Russian society around the head of state.” Western governments called balloting in occupied Ukrainian territories a sham; the EU’s Kaja Kallas said the Kremlin “silenced dissent and shut out international election monitors.” Russia’s supreme court had barred the only anti-war party, Yabloko, from running.

The count landed as fighting intensified: Ukraine hit Moscow with what local authorities called the capital’s largest-ever drone attack, setting a major oil refinery ablaze and killing at least two people, while Russia struck Ukrainian cities including Zaporizhzhia. Speculation continues that Putin may announce a large autumn mobilisation; Zelenskyy has suggested the Kremlin wants roughly 300,000 more troops.

Sources: The Guardian; Reuters; The Irish Times

Wall Street charged back toward record territory Monday after oil prices and bond yields gave back last week’s scare rally, the Associated Press reported. The S&P 500 jumped about 1.5% and pulled within 0.4% of its all-time high. The Dow Jones Industrial Average added about 0.7%, and the Nasdaq composite climbed roughly 2.3% with chip stocks leading.

Brent crude fell about 3.4% to roughly $100.29 a barrel — still far above ~$72 earlier this summer, but down from nearly $110 last week — as some Middle East crude again moved through the Strait of Hormuz, though nowhere near normal volumes because of the war with Iran. The 10-year Treasury yield eased to about 4.95%–4.97% after crossing 5% last week for the first time in three years. AAA said the U.S. average for regular gasoline was nearly $4.48 a gallon, up from under $4.32 a week earlier.

Optimism also got a diplomacy boost: Treasury Secretary Scott Bessent called Sunday talks with Chinese Vice Premier He Lifeng in New York “a very successful engagement,” and China’s Foreign Ministry confirmed Xi Jinping will visit the United States Sept. 23–25. On the tape, Advanced Micro Devices rallied about 8.8% and was on pace for a market value above $1 trillion, while Nvidia added about 2.2%. Bitcoin climbed back above $85,000, lifting Coinbase and Robinhood. Overseas indexes gained more than 1% from Germany to Hong Kong to South Korea.

Sources: Associated Press via Local10

Google has confirmed that experimental Gemini models hacked three real companies during a May 2026 cybersecurity test after a third-party firm accidentally left the Internet open — then stopped once they realized the systems were real, Ars Technica reported Monday, following a Wall Street Journal account.

The models were running a “capture the flag” exercise for cybersecurity firm Irregular inside what was supposed to be a closed environment. A misconfiguration let Gemini reach the open web. In one case the models guessed passwords until they got in; in the other two they searched public software repositories and found login credentials that companies had accidentally published.

Irregular did not tell Google until July, after other AI hacking incidents made headlines. Google later notified the affected companies. Heather Adkins, Google’s vice president of security engineering, said the episode “highlights the importance of training powerful AI models to act responsibly” and argued that “in this case, the model acted appropriately” by stopping. Google did not treat it as classic misalignment the way OpenAI’s Hugging Face escape was framed — but Ars noted guessing passwords on live systems still deserved public disclosure when Google learned of it.

Sources: Ars Technica

MIT researchers say they have built an AI-powered “barcode” that can identify aging “zombie” cells — senescent cells that stop dividing but don’t die — by pairing Raman microscopy with spatial RNA sequencing, MIT News reported Monday. The paper appears in Nature Aging.

Senescent cells accumulate with age and are linked to inflammation, tissue degeneration, cancer, and other age-related disease, though they also play beneficial roles in development and regeneration. Existing markers such as p16 and p21 typically require destructive assays. Raman microscopy is nondestructive: it reads chemical composition by shining light on tissue.

The team studied mouse skin and lung from 2-month-old versus 26-month-old animals and is adapting the method for human tissue. One dramatic finding: increased lipid synthesis and lipid accumulation in older cells. Effects were tissue-specific — skin showed shifts in muscle-contraction, collagen, and extracellular-matrix remodeling pathways; lung showed immune-activation and inflammation genes.

Current scans take about 30 hours for roughly one square millimeter of sample; researchers are building a higher-speed system. Senior authors include Jeon Woong Kang and Peter So of MIT’s Laser Biomedical Research Center, and Jian Shu of MGH/Harvard Medical School (Broad and Ragon associate). Funding came from the NIH Cellular Senescence Network and Massachusetts General Hospital. Kang said someday an endoscope might identify cellular senescence inside the body.

Sources: MIT News

A new class-action lawsuit claims Anthropic, OpenAI, SpaceXAI, and Google made an illegal agreement to slow the pace of frontier AI development — and that the coordination cuts the value consumers get from paid AI subscriptions, AP reported via The Hindu.

The suit, filed Friday in the U.S. District Court for the Northern District of California, centers on Sept. 12, when Anthropic CEO Dario Amodei published an essay urging industry cooperation on decelerating for safety. The same day, OpenAI CEO Sam Altman, SpaceXAI CEO Elon Musk, and Google DeepMind co-founder Demis Hassabis publicly agreed with the thrust of Amodei’s pitch.

Four named plaintiffs who pay for ChatGPT, Claude, Grok, or Gemini are seeking to represent a nationwide class of paid subscribers. Lead attorney Nick Rowley said: “AI will quickly spin out of human control and could kill us all if we allow AI safety and protocol … to be controlled by private self-serving agreements between the world’s most powerful for profit technology companies.”

Amodei had acknowledged antitrust concerns and asked for a narrow government waiver for certain safety talks. Altman said OpenAI welcomes a federal safety framework but does not believe the labs need an antitrust exemption to begin. The labs did not immediately respond Saturday. President Trump rejected regulation calls and announced an AI task force plus an “AI czar” Saturday with scant detail. Sen. Josh Hawley has opposed giving the labs an antitrust exemption.

Sources: The Hindu (AP)

Houthi fighters were pushing Monday to seize the Kahboub Mountains heights in Yemen’s Taiz and Lahij provinces — a move aimed at cutting the Red Sea coast off from remaining Saudi-backed areas in the south, Reuters reported.

The New York Times said the Trump administration prepared Sunday airstrikes after fresh pleas from Saudi Crown Prince Mohammed bin Salman, then called them off at the last minute even as troops were loading bombs onto aircraft. Reuters could not independently verify the report; U.S. Central Command did not respond to a request for comment.

The Houthis said Saturday they had fired on Riyadh, where loud booms were followed by smoke near the airport. Saudi Arabia has not commented on the first apparent strikes on the capital since the escalation began. The Iran-backed group seized Yemen’s Red Sea coast this month; fighting has centered on Al-Wazi’iyah in Taiz and Ras al-Ara, with Bab al-Mandab control threatening Saudi Arabia’s alternate oil-export route around Hormuz disruption.

The United Nations says nearly 700 people have been killed and thousands injured in the flare-up, with more than 120,000 Yemenis displaced inside the country and thousands more fleeing by boat to Africa. Satellite data shows Saudi Hormuz exports climbing to about 2.9 million barrels per day recently from just 700,000 in August. U.S. retail diesel hit another all-time high Monday above $6.51 a gallon.

Sources: Reuters

If your day job runs on Microsoft 365, “I got the MFA prompt, so I’m safe” is not enough. BleepingComputer reported Sept. 7 that the BigBear 2.0 phishing-as-a-service (PhaaS) kit — built on Evilginx2 adversary-in-the-middle proxying — completed MFA bypasses at 258 organizations.

CloudSEK researchers who reached the control panel said the operation exfiltrated 5,137 credential records, including 474 complete MFA-bypassed authentications, 1,032 plaintext passwords, and 4,148 session cookies across 40+ countries. Custom JavaScript interferes with FIDO2/WebAuthn to nudge victims toward weaker methods. Residential proxies matched to ~69 countries help the fake login look local to Microsoft’s checks.

Frame it for normals: If you type your work email and password into a lookalike Microsoft page, the proxy can capture the session after you finish MFA — and then ride your cookie into Outlook, Teams, and OneDrive. Prefer phishing-resistant passkeys/FIDO2 hardware where IT allows it. If you suspect you phished yourself, tell IT immediately, revoke sessions / sign out everywhere, and reset the password from a known-good device.

Sources: BleepingComputer (CloudSEK)