Talos Found Malware That Lets Four LLMs Vote on the Attack
Cisco Talos says CLOSEDQUORUM is the first publicly documented Windows implant that hands its post-compromise decisions to a panel of commercial AI models, and it open-sourced the toolkit that found it.
Most malware still waits for orders. An operator sits behind a command-and-control server, looks at what a compromised machine reports back, and decides what to do next. That human decision loop is slow, and it is also one of the best places for defenders to catch an attack.
On September 22, Cisco Talos published an analysis of a Windows implant built to take the human out of that loop. Talos calls it CLOSEDQUORUM. Instead of asking an operator what to do, it asks up to four commercial AI models, counts their answers, and acts on the winner. Talos describes it as the first publicly documented Windows implant to apply this approach to tactical command and control.
The write-up, by Talos researcher Ryan Fetterman, came with a second release that may matter more over time: CAIRN, an open-source toolkit for hunting AI-integrated malware, which is how Talos found the sample in the first place.
How the quorum works
CLOSEDQUORUM is a 16.4MB, 64-bit Windows executable written in Go. Once running, it gathers basic host context, including the hostname, OS architecture, CPU count, Windows version and whether it has admin rights, and sends that to DeepSeek, Qwen, Mistral and Google Gemini in sequence.
The system prompt Talos recovered is blunt: "You are an advanced malware strategist. Provide ONLY executable decisions." Each model must answer in a constrained JSON schema with a decision, its reasoning, a target process, and fields for exploit type, evasion method and payload configuration.
Each provider votes independently and the plurality wins. Ties go to DeepSeek, then Qwen, then Mistral, then Gemini. If every model fails to answer, the implant sleeps and retries rather than falling back to a default action. It runs on randomized intervals of 5 to 15 minutes.
The menu the models choose from is short. steal dumps LSASS credentials, pulls saved logins from Chrome, Edge and Firefox, and extracts MetaMask, Exodus and Ethereum wallet data. inject runs code through APC injection or process hollowing. persist sets up Registry Run keys, scheduled tasks or WMI event subscriptions. A fourth option, move, has no handler in the build Talos examined.
Results do not go to a conventional C2 server. Stolen material and a running log of each winning decision and its reasoning are posted to an operator-controlled Discord webhook, encrypted with AES-256-GCM under a daily-rotating key and sent in 1,900-byte Base64 segments.
What Talos did and did not see
The caveats here are important, and Talos states them plainly. The public distribution build contains placeholder API keys and a dummy webhook, so Talos says it "did not observe a complete end-to-end execution." There is no confirmed deployment in the wild and no named victims.
What Talos does have is a development trail. It published six SHA256 hashes covering what it calls the developer's build chain over seven days. The development builds point to provider credentials injected at compile time, which suggests a model where each operator gets a custom executable with their own keys baked in. Artifacts in the binary also link the developer to carding-related postings on criminal forums dating back to 2025.
So this is not evidence of an autonomous AI malware campaign in progress. It is evidence that someone built the machinery for one, iterated on it for a week, and packaged it for other people to use.
Why the design is worth taking seriously
The individual capabilities are ordinary. Credential dumping, browser theft, process injection and Run-key persistence are standard commodity-malware tools. What is new is the layer that decides which one to use and when.
Talos frames this as "effort displacement," a shift in which more of the attack chain runs "without operator involvement." A traditional C2 setup needs infrastructure and someone watching it. Here the infrastructure is borrowed from four public AI APIs and a chat platform's webhooks, and the judgment is outsourced to models.
The voting design is also a practical choice. Using several providers means one refusal or outage does not stop the implant, and the tie-break order shows which model the developer trusted most. The self-reported "Reasoning" field is sent back to the operator too, which makes each decision reviewable later.
There is an obvious weakness, and defenders should use it. An implant that depends on commercial AI APIs depends on those providers not noticing. Keys can be revoked and abusive traffic patterns can be flagged. That dependency is also why Talos expects keys to be injected per build rather than hard-coded once.
CAIRN, the hunting side
CAIRN, short for Cognitive Artifact Intelligence Research Network, is on GitHub under Cisco-Talos. Help Net Security describes it as metadata-first: it classifies samples from the traces AI-integrated malware leaves in its code and file metadata, such as embedded prompts, provider API endpoints, orchestration logic and text written to evade AI-based sandboxes, without executing the sample.
It sorts findings into three tiers: samples that simply contain AI-related strings, samples with operational AI integration, and confirmed named families. According to Help Net Security, its corpus reaches back to July 2025, when LAMEHUG was first reported.
The approach fits the threat. A binary that talks to a language model has to carry a prompt, an endpoint and usually a response schema. Those are strings, and strings can be hunted at scale long before anyone detonates the file.
What defenders should do now
Talos warns against simply blocking AI provider domains, since plenty of legitimate software now calls these services. The better signal is the combination. Few legitimate applications, in Talos's words "far fewer," contact multiple AI providers while also touching LSASS, injecting into suspended processes or creating WMI persistence.
In practice that means three things. First, inventory which executables on your endpoints talk to AI APIs at all, because that list should be short and explainable. Second, correlate that traffic with credential access and injection telemetry rather than alerting on either alone. Third, watch for outbound Discord webhook traffic from machines that have no business using Discord, along with the ETW telemetry suppression Talos lists among its indicators.
CLOSEDQUORUM did not arrive fully working. But it shows what the next generation of commodity malware may look like: standard tools, with a rented committee of models deciding how to use them.