Cisco Talos finds malware that lets four AI models vote on its next move

Cisco Talos disclosed CLOSEDQUORUM on September 22, describing it as the first publicly documented Windows implant to delegate its command-and-control decisions entirely to a panel of commercial large language models rather than a human operator. The 16.4MB, 64-bit Windows executable, compiled in Go, queries up to four AI providers — DeepSeek, Qwen, Mistral, and Google Gemini — and uses plurality voting among them to decide its next post-compromise action.

How the AI panel actually works

Rather than following a hardcoded attack script or waiting for operator commands, CLOSEDQUORUM presents its current situation to all four models simultaneously and executes whichever action gets the most votes. Talos identified four possible actions built into the implant: steal, which simultaneously targets LSASS credentials, browser-stored passwords, and cryptocurrency wallets; inject, which performs process injection via APC or process hollowing; persist, which establishes multiple separate persistence mechanisms so the infection survives a partial cleanup; and move, a lateral-movement capability present in the code's architecture but without a working handler in the sample Talos analyzed — suggesting it's either still in development or was deliberately left disabled in this build.

CAIRN: a toolkit built to catch this pattern at scale

Alongside the CLOSEDQUORUM disclosure, Talos released CAIRN (Cognitive Artifact Intelligence Research Network), an open-source toolkit designed to hunt for AI-integrated malware without executing suspicious binaries. CAIRN works by scanning file metadata for the telltale signs of LLM integration — embedded prompt templates, hardcoded API endpoints, and jailbreak-style instruction fragments — rather than running the malware in a sandbox to observe its behavior. That distinction matters: a metadata-first approach can flag AI-driven malware at scanning speed across large file sets, where dynamic analysis would be far slower and could tip off attackers monitoring their own infrastructure.

Why voting matters more than the specific capabilities

None of CLOSEDQUORUM's individual capabilities — credential theft, process injection, persistence — are new; commodity malware has done all three for years. What's genuinely novel is the decision-making architecture: by querying four separate commercial AI providers and going with the majority result, the malware's operators built in a crude form of redundancy against any single provider detecting and blocking the malicious queries. If DeepSeek's safety filters catch and refuse a request, Qwen, Mistral, or Gemini can still supply the deciding vote. That's a direct response to AI providers' existing efforts to detect and block malicious use of their APIs — and a preview of how that arms race escalates once attackers stop relying on a single model.

What Talos didn't find

Talos noted there is no confirmed evidence of CLOSEDQUORUM being deployed in the wild. Instead, researchers connected artifacts from the binary to postings on criminal carding forums dating back to 2025, tying the sample to an existing threat actor's infrastructure rather than to a confirmed live campaign. That distinction is worth holding onto: this is a disclosed capability and a working proof-of-concept, not a documented breach.

Why this sets a precedent regardless

Security researchers have long anticipated AI-orchestrated malware in the abstract; CLOSEDQUORUM is the first concrete, analyzed example of the pattern actually built and functional. Its existence — even without confirmed in-the-wild deployment — gives defenders something they didn't have before: a real specimen to build detection signatures against, which is precisely what CAIRN's release alongside the disclosure is designed to enable industry-wide.