ClosedQuorum malware asks AI models what to do next

A new Windows malware family called ClosedQuorum uses commercial AI models to decide what to do after it has compromised a machine, according to a report published by BleepingComputer on 22 September 2026.

The malware queries Google Gemini, DeepSeek, Qwen and Mistral models to autonomously determine which actions to take during the post-compromise stages of an attack, the report said. Post-compromise is the phase after initial access, when an intruder decides what to steal, where to move next and how to stay hidden. In conventional malware, those choices are either hard-coded by the author or issued by a human operator through a command-and-control server. ClosedQuorum instead outsources at least part of that decision-making to a language model.

That design matters for defenders because it changes what the malware looks like on a network. Behaviour driven by a model can vary between infections, so two machines hit by the same sample may not produce the same sequence of commands. It also means some of the malware's outbound traffic goes to AI providers rather than to attacker-controlled infrastructure, which is harder to treat as inherently suspicious given how many legitimate applications now talk to the same services.

The use of four different providers is notable in itself. Relying on more than one model vendor gives an operator redundancy if one provider blocks an account, detects abuse or changes its safety filtering. Each of the four named services is reachable over an ordinary web API, which is the same access route available to any paying developer.

Details released so far are limited. The report does not identify a vendor whose product was breached, because ClosedQuorum is malware rather than a flaw in a specific piece of software. No information has been published about how the malware reaches victim machines, how many systems have been affected, who is behind it, or which regions or sectors have been targeted. There is no indication in the report of how the AI providers have responded, or whether the accounts used to query their models have been suspended.

The case is a practical example of a risk that security teams have been describing in the abstract for some time: general-purpose AI services being used as a planning layer for intrusions, rather than merely as a tool for writing phishing emails or code. Organisations that monitor outbound connections may want to consider how they distinguish legitimate AI API traffic from the same traffic generated by an implant. Further technical detail will be needed before defenders can build reliable detections for this family.