Incident database

Windows malware CLOSEDQUORUM lets AI models vote on next move

Cisco Talos disclosed a Windows malware sample, CLOSEDQUORUM, designed to have up to four AI models vote on actions like stealing Windows credentials, browser passwords, and crypto wallet data instead of relying on an attacker's command server. Talos has not observed the full chain working and says the publicly available version is non-functional.

Disclosed 22 September 2026 · Record updated 1 October 2026

Our coverage

Vulnerabilities

Malware lets four AI models vote on its next move

Cisco Talos says the CLOSEDQUORUM sample hands decisions to a panel of AI models rather than an attacker's server, but the public copy does not run.

23 Sept 2026