Windows malware lets four AI models vote on its next move

Cisco Talos said on 22 September 2026 that it has found a new Windows malware strain, called CLOSEDQUORUM, that asks up to four large language model providers to decide what it should do on an infected machine. According to Talos, the researchers have not observed any in-the-wild deployment of the malware, so there are no known victims at this stage.

The Go-based implant queries Google Gemini, DeepSeek, Qwen and Mistral in sequence and tallies their answers, Talos said. The models pick from a fixed list of post-compromise actions, and the binary then carries out whichever action wins the vote. If the vote is tied, DeepSeek's answer takes precedence, followed by Qwen, Mistral and Gemini. Once deployed, the malware does not need further commands from a human operator, which Talos describes as, to its knowledge, the first publicly documented case of a Windows implant using this approach for command-and-control.

"The session is closed; no humans are admitted," Talos analyst Ryan Fetterman wrote in the company's blog post. "Four models are queried in sequence, their independent verdicts tallied, and the binary acts, based on their judgment." Fetterman called this "effort displacement", meaning a phase of the attack moves from a person to an AI system. He argued that this removes a bottleneck, because human operators are limited by attention, working hours and cognitive load, while an automated component "does not go offline when the attacker sleeps".

The models' choices are constrained. A system prompt that Talos extracted from the binary tells each model, "You are an advanced malware strategist," and instructs it to pick "ONLY executable decisions". The available capability modules are Steal, Inject and Persist. Steal runs several commands at once: dumping LSASS memory to grab Windows credentials, taking saved browser passwords from Google Chrome, Microsoft Edge and Mozilla Firefox, and extracting cryptocurrency wallet data including MetaMask, Exodus and Ethereum. Inject generates shellcode and runs it using process hollowing or Early Bird injection, two techniques for hiding code inside another process. Persist sets up persistence so the malware survives on the device.

Talos believes the developer hands each operator a customised executable, with that operator's Discord webhook address and LLM API keys compiled into the file. Stolen credentials are sent to the operator's Discord channel and encrypted with AES-256-GCM using a daily rotating key derived from the message timestamp. Artifacts in the binary link the developer to postings on criminal forums dating back to 2025 that relate to carding, according to Talos.

The company said it found the sample using a new toolkit called CAIRN, short for Cognitive Artifact Intelligence Research Network, built for hunting, classifying and tracking AI-integrated malware. Talos published CAIRN as an open source repository on the same day.

On defence, Fetterman said the "most useful detection strategy" is behavioural, not blocking domains. "Legitimate applications may contact DeepSeek, OpenRouter, Mistral, Gemini, or Discord independently," he wrote. "Far fewer should contact several of them while also accessing LSASS, injecting into suspended processes, or creating WMI persistence." In other words, defenders should look for the combination of AI service traffic and classic intrusion behaviour on the same host, rather than treating calls to model providers as suspicious on their own.