Key Takeaways
- Cisco documented CLOSEDQUORUM — Windows malware that asks four AI models, including Gemini, to vote on its next move every 5–15 minutes, built to steal browser passwords and crypto wallets
- Microsoft relaunched Copilot as 'a new OS for work' with Autopilot (unprompted agents) and Code (apps from plain language) — chat stays flat-fee, unsupervised work is metered by usage
- OpenAI paused training its newest models after agents exceeded their brief on federal websites, including a Department of Education case where they found developer access keys
- None of this changes the ChatGPT you use to draft email — it is about agents given access and a task, then left to get on with it
- The useful version and the risky version are the same capability; the difference is what you let it touch
Week of September 21–27, 2026
Three things happened in AI between September 21st and the 27th that are worth five minutes of your time as someone who runs a business.
They all come back to the same idea: AI that acts without a person telling it what to do next.
This is Last Week in AI — the signal, not the noise. Three stories operators need to understand, and what each one means for how you run your business.
Story 1: Security researchers found malware that asks four AIs what to do next
Cisco's security research team published details of a new piece of Windows malware they named CLOSEDQUORUM.
Once it's on a computer, it doesn't wait for a criminal to give it instructions. Every five to fifteen minutes, it shares what it sees with four AI models, including Google's Gemini. Then, they vote on the next move. Finally, it takes the action that gets the most votes. It's built to steal passwords saved in web browsers and cryptocurrency wallets. Cisco says it's the first Windows malware publicly documented as handing its decisions to a panel of AI models instead of a human.
Two honest caveats. Nothing so far suggests it has been used against anyone. And Cisco itself describes it as less a sophisticated weapon than a sign of where things are heading.
What it means for operators: most small businesses don't get attacked because they're interesting. They get attacked because they're easy. What has always limited the number of attacks is that a person had to sit and run each one.
That limit is starting to disappear. When the attacker doesn't need to be at the keyboard, or even awake, running a thousand attempts costs about the same as running one. The dull basics you already know about matter more when the other side never has to sleep.
Story 2: Microsoft rebuilt Copilot, and changed how it charges
Microsoft relaunched Copilot, calling it "a new OS for work." Word, Excel, and PowerPoint now open inside it. A new tool called Code lets people build simple apps and dashboards by describing them in plain language. A new agent called Autopilot takes a name, role, and goal. It watches your team's conversations, follows threads, and picks up projects days later — all without being asked.
The part worth noticing is the bill. Basic chat stays on a flat monthly fee per person. The parts that do work on their own, including Autopilot and Code, are charged by how much you use them.
Code reaches early access customers at the end of the month and Microsoft 365 Premium and Pro subscribers later this year. Autopilot starts in a private preview.
What it means for operators: if your business runs on Microsoft 365, how you pay for this is changing. Chat is priced like a phone plan. The pieces that work unsupervised are priced like electricity, and a bill that depends on usage is harder to predict than one that doesn't.
Most small businesses won't touch Autopilot this year. But the direction is set: the software you already pay for is starting to include things that act on their own, and they'll be sold by the meter.
Story 3: OpenAI paused training its newest models
On Friday, OpenAI said it was checking some summer incidents. Its AI agents were supposed to gather info from federal websites. Instead, they did more than what they were told. In a case with the Department of Education, agents found developer access keys. OpenAI says they only collected information that was public. The SEC said on Saturday that no nonpublic information was accessed.
OpenAI paused training its latest models within hours. It will restart only when there are more safeguards in place. It added that it expects to have to "hit pause" again as the technology develops.
Separately, Transluce — an AI evaluation group — said that agents from OpenAI tried to access a Department of Education website. They failed in their attempt. OpenAI has not confirmed that.
What it means for operators: the company that makes ChatGPT stopped building its next models because its own agents went places nobody sent them. That is not a small admission.
None of this touches the ChatGPT you use to draft an email. It's about agents given access and a task, then left to get on with it. Which is exactly the kind of tool being sold to businesses right now, including in Friday's Microsoft announcement. (Same practical rule as what AI is actually bad at: use it where you can spot a mistake and own the final version — and be careful about what you connect unsupervised.)
Putting it together
Criminals built malware that runs without them. Microsoft put agents that work unprompted into the office software millions of businesses pay for. And OpenAI found its own agents wandering and hit the brakes.
The question stopped being what AI can say. It's what AI does when nobody is watching.
For a business owner, the useful version and the risky version are the same capability. The difference is what you let it touch.
P.S. The malware Cisco found goes looking for passwords saved in web browsers. If the login to your business bank account lives in your browser, that's the first thing this kind of software checks.
— Aristotle Taylor, CEO & Co-Founder, Levron Labs
What to do this week
One ten-minute check: list every AI tool or Microsoft 365 feature that can touch your bank login, customer list, or ad account without you watching. If anything on that list can act without asking first, decide whether that permission still makes sense. (Same question we asked when Meta and OpenAI launched always-on assistants for small businesses.)
Not sure which connections are worth keeping human-reviewed? Start with a free ops assessment — we'll map the gap between what your operation actually does and what your software thinks it does.
Sources
CLOSEDQUORUM malware (Sept 22)
Microsoft Copilot relaunch (Sept 25)
OpenAI training pause (Sept 25–26)