Malware lets four AI models vote on its next move

Cisco Talos disclosed a Windows malware sample on 22 September 2026 that is built to take its orders from a vote of up to four AI models rather than from an attacker's command server. The sample, named CLOSEDQUORUM, can be directed by that vote to steal Windows credentials, saved browser passwords and cryptocurrency wallet data, Talos said. The company has not seen the full chain work from start to finish, and said the publicly available version of the malware does not work as it is.

The design is the notable part. Conventional malware phones home to infrastructure the attacker controls, which is also the thing defenders hunt for and take down. CLOSEDQUORUM instead puts the decision about what to do next to a group of AI models, with the majority result driving the action. In principle that removes the single server that incident responders normally use as a chokepoint, and makes the malware's behaviour harder to predict from one run to the next.

The targets described by Talos are ordinary credential theft: the credentials Windows itself stores, the passwords saved in a browser, and the key material used by cryptocurrency wallets. Those are the same categories of data that commodity information stealers have gone after for years. What changes is who or what chooses the moment and the method.

Talos was clear about the limits of what it found. It has not observed the voting mechanism operating end to end, and the copy of the malware that is publicly available is non-functional. That places CLOSEDQUORUM closer to a demonstration of an idea than to a campaign with confirmed victims. No affected organisations have been named, and Talos did not attribute the sample.

For defenders, the practical reading is narrow for now. There is no evidence in the disclosure of a working deployment, so the immediate risk described is low. The longer-term point raised by the sample is that detection strategies built around identifying and blocking command-and-control traffic assume the attacker keeps a server in the loop. A model-driven decision layer, if it ever worked reliably, would not fit that assumption.

Talos published the analysis on 22 September 2026. Anyone monitoring for this behaviour should treat the published sample as a reference point rather than as live tooling, given the company's statement that it does not function in its current form.