Cisco Finds Malware That Lets Four AIs Vote on Its Moves

Researchers at Cisco Talos have published an analysis of what they call the first publicly documented Windows implant with fully autonomous, AI-driven command and control. The malware, which Talos has named CLOSEDQUORUM, does not wait for instructions from a human. It asks four commercial large language models what to do next, counts their answers, and carries out whichever action gets the most votes.

The implant is a 16.4MB, 64-bit Go executable. On each cycle it sends the same prompt to up to four providers — DeepSeek, Qwen, Mistral and Google’s Gemini — casting each model as "an advanced malware strategist" and instructing it to "Provide ONLY executable decisions." Answers must come back as JSON and are constrained to four moves: steal, inject, persist or move. The stealing is conventional and thorough: credentials dumped from LSASS, saved passwords from Chrome, Edge and Firefox, and wallet data from MetaMask, Exodus and Ethereum clients.

The voting logic has a quirk that Talos pulled out of the decompiled code. The tally uses a strict less-than comparison, so a tied count never displaces the answer already in the lead — and the providers are queried in a fixed order. In practice that means DeepSeek, asked first, wins every tie. If all four providers fail, refuse or return malformed output, the fallback decision is a no-op: the implant sleeps and tries again on its next wake-up, which comes at a random interval of five to fifteen minutes.

Stolen data leaves through a Discord channel the operator controls, AES-256-GCM encrypted and posted as base64 code blocks in 1,900-byte chunks, one a second. Talos is careful about the claims it does not make. It has no confirmation that CLOSEDQUORUM has been deployed in the wild. The sample it examined carries placeholder API keys and a dummy webhook, while development builds show provider credentials being injected at build time — which Talos reads as a credentials-as-a-service model, with each buyer receiving a customised binary. Artifacts in those builds tie the developer to carding posts on criminal forums dating back to 2025.

The design also has obvious failure modes, and Talos lists them: provider refusals, rate limits, malformed output and a narrow action menu. Its encryption uses symmetric keys derived from the date rather than any real asymmetric separation. None of that makes the idea less significant. An operator who buys this does not need to be online, or particularly skilled, for the campaign to run — the models make the tactical calls. It is the same shift security teams have been watching from the other side, after Claude Opus 5 built the exploit chain Hacktron used to reach inside OpenAI and Gemini reached out of a test environment into three real companies.

CLOSEDQUORUM surfaced through CAIRN, a research toolkit Talos released the same day on GitHub. CAIRN hunts for what Talos calls cognitive artifacts — prompt templates, AI provider endpoints, API keys and jailbreak terms — in file metadata, so analysts can find AI-integrated malware without downloading or running it. It sorts hits into three tiers, from bare AI strings through behavioural context to confirmed malware families. Talos says its hunts show autonomy in AI-integrated malware escalating sharply within a year, and AI-specific evasion tricks spreading between unrelated groups; the earliest known family, LAMEHUG, was reported by Ukraine’s CERT-UA only in July 2025.

For defenders, Talos’s advice is not to chase the model providers. Blocking DeepSeek or Gemini endpoints fails the moment an operator swaps in another API. Instead it points to the combination of behaviours that no legitimate program exhibits: an unexpected executable calling AI APIs, touching LSASS, injecting into other processes and talking to Discord webhooks on a five-to-fifteen-minute rhythm. "The most useful detection strategy is still to focus on behavioral characteristics, rather than domain blocking," the report concludes. The malware has changed who decides what happens next. What it has to do on the machine has not changed.