Cisco Talos Discloses CLOSEDQUORUM, Malware That Lets Four AI Models Vote on Its Next Move

Cisco Talos, the security research arm of Cisco Systems, disclosed on September 22, 2026 what it calls the first publicly documented Windows malware that hands a post-compromise decision to a panel of commercial AI models rather than to a human operator. The implant, named CLOSEDQUORUM, is a 16.4 MB, 64-bit Windows executable written in Go with embedded C code for direct system calls. Once running on a compromised machine, it does not wait for instructions from an attacker. Instead it queries up to four AI providers and acts on whichever answer wins a vote.

How the vote works

According to the Talos writeup, CLOSEDQUORUM gathers information about the host it has landed on and submits it to four large language model APIs in sequence: DeepSeek, Qwen, Mistral and Google Gemini. Each model is asked to choose from a fixed, constrained set of next actions — stealing credentials, injecting code, establishing persistence, or moving laterally. The malware counts the four responses and executes whichever action received the most votes; if the vote splits evenly, it falls back to a fixed tie-break order that favors DeepSeek, then Qwen, then Mistral, then Gemini. Talos describes this as "plurality voting" applied to a single, narrow phase of an attack, not to an entire campaign.

The malware is built to steal Windows domain and local credentials via LSASS memory dumping, browser-saved passwords from Chrome, Edge and Firefox, and cryptocurrency wallet data from MetaMask, Exodus and other Ethereum-focused applications. Stolen material is reported to leave the machine AES-256-GCM encrypted, packaged as base64 text and posted to a Discord channel over a webhook rather than to conventional command-and-control infrastructure, a technique meant to blend the traffic in with legitimate app activity.

What Talos has, and hasn't, confirmed

Talos is explicit that it has not confirmed CLOSEDQUORUM operating against real victims. The analyzed sample shipped with placeholder API keys and dummy webhook addresses, meaning the autonomous loop has been verified through static and code analysis rather than observed executing live. Researchers also found that the encryption key used to protect stolen data is derived from the current date rather than a proper secret, a flaw that would let the malware's own developers decrypt any data it exfiltrates — a detail consistent with the sample being sold as a credentials-as-a-service kit rather than built for a single operator's exclusive use. Artifacts tied to the malware's developer trace back to postings on criminal forums dating to 2025, according to Talos.

Independent commentary has largely echoed that caution. In coverage from Help Net Security, Talos researcher Ryan Fetterman called the sample "an early and limited example," while framing the disclosure as a chance for defenders to study the shift before autonomous decision-making in malware becomes routine.

CAIRN: hunting by metadata, not by detonation

Alongside the CLOSEDQUORUM writeup, Talos released CAIRN — the Cognitive Artifact Intelligence Research Network — an open-source toolkit for finding malware that leans on AI systems. CAIRN works entirely from file metadata already indexed by VirusTotal, without downloading or running the binaries it examines. Its premise is that malware built around large language models leaves recoverable traces even when dormant: hardcoded prompts, calls to LLM provider endpoints, imports from frameworks such as LangChain or LiteLLM, references to local model runtimes like Ollama or GGUF files, agent-style function-call syntax, and strings written to evade AI-based sandboxes. CAIRN classifies what it finds using a tiered set of YARA rules — primitive artifacts, behavioral context, and family-level attribution — combined with embedding-based clustering to group related samples. The toolkit is published under the MIT license on GitHub, and Talos has been running the hunting process behind it since July 2025.

Part of a broader pattern

Talos and independent reporting place CLOSEDQUORUM in a short but growing line of malware that integrates commercial AI models directly, following earlier documented cases such as LAMEHUG, identified in July 2025. Talos's own framing, reported by Security Affairs, is that the meaningful change is not that AI makes any single attack step more sophisticated, but that it lets an operator remove themselves from stretches of an intrusion that previously required active attention — what the researchers term "effort displacement." Whether or not CLOSEDQUORUM itself is ever found running against a live target, Talos is presenting CAIRN as infrastructure for catching the next version of this pattern earlier, by treating the AI-integration code itself as a searchable signature rather than waiting to observe the malware in action.