A Windows malware sample that asks four separate AI models to vote on what it should do next has just been documented for the first time, and security researchers are calling it a preview of where malicious code is headed. Cisco Talos disclosed the implant, named CLOSEDQUORUM, on September 22, 2026, alongside a new open-source detection framework built specifically to catch this class of threat. The story was first reported by The Register and followed a day later by The Hacker News, with additional coverage from BleepingComputer, SiliconANGLE, and Help Net Security.
What makes CLOSEDQUORUM different from the wave of AI-assisted malware that has cropped up over the past two years isn’t that it was written with help from a chatbot. It’s that the binary itself, once running on a victim’s machine, phones out to commercial AI services and lets them decide, by majority vote, what to do to that machine. No attacker sits at a keyboard issuing commands in real time. The malware brings the decision to a panel, tallies the answers, and acts.
Don't miss new tech stories on Google
Add Tech Insider once in the Google app and our stories appear in your news suggestions.
What CLOSEDQUORUM Actually Does
According to Cisco Talos, CLOSEDQUORUM is a 16.4 MB Go-based Windows implant that, after gaining a foothold on a target machine, gathers basic reconnaissance data about the host and then queries up to four commercial large language model services in sequence: DeepSeek, Qwen (Alibaba’s model family), Mistral, and Google Gemini. Each model is shown the same reconnaissance snapshot and asked to pick from a fixed menu of post-compromise actions rather than being given free rein to output arbitrary commands. Reported options on that menu include harvesting Windows credentials, pulling saved browser passwords, targeting cryptocurrency wallet files, injecting code into other processes, establishing persistence on the host, and lateral movement, though Talos noted that the lateral-movement option was the one non-functional action across the samples it analyzed, a sign the implant may still be under active development.
Once all four models return a vote, the malware counts them and executes whichever action received the most support. If the vote splits evenly, Talos’s September 2026 writeup identifies DeepSeek as the designated tie-breaking vote, with the fallback order running DeepSeek first, then Qwen, then Mistral, then Gemini. Researcher Ryan Fetterman of Cisco Talos summarized the design in the disclosure post: “It does not require continued commands from a human operator or tasking from a dedicated, attacker-operated C2 server; the complete dynamic operation is delegated to the AI,” Fetterman wrote in the Talos blog post.
Talos says the decision loop repeats rather than firing once, and SiliconANGLE’s September 2026 coverage pinned down just how often: CLOSEDQUORUM re-polls its four-model panel for a fresh instruction roughly every 5 to 15 minutes rather than running a single static playbook. That detail matters: it turns each infected machine into something closer to a standing committee than a one-shot payload, re-litigating its next move on that cadence without ever touching a traditional command-and-control server that defenders could simply block at the firewall.
Who Found It, and How
CLOSEDQUORUM surfaced through CAIRN, a new open-source framework Cisco Talos released the same day specifically to hunt for malware that integrates AI services into its execution logic. CAIRN isn’t the malware’s name, it’s the tool that found it, scanning binaries and network telemetry for the telltale signature of a program that calls out to LLM APIs mid-execution rather than using them only at build time to generate code. Fetterman described CLOSEDQUORUM as “the first publicly documented Windows implant to apply this model to tactical command and control (C2),” a claim about the public record of documented samples rather than a guarantee that nothing similar exists undetected elsewhere.
That framing is important for readers trying to gauge how alarmed to be. Talos is not reporting a mass-infection event, a confirmed victim count, or a prevalence percentage, and as of September 2026 the company says it has confirmed zero in-the-wild deployments of CLOSEDQUORUM. The available reporting from Talos, The Register, and The Hacker News does not include an infection tally, a detection rate, or evidence that CLOSEDQUORUM has been deployed against real organizations at scale. What’s newsworthy is the architecture, not (yet) the blast radius.
The Voting Mechanism, Step by Step
Based on the Talos disclosure and corroborating reporting, the operational sequence looks like this once CLOSEDQUORUM lands on a Windows host:
- The implant collects host reconnaissance data, machine details, running processes, and available credential stores.
- It packages that snapshot into a prompt and sends it to up to four external AI APIs: DeepSeek, Qwen, Mistral, and Gemini.
- Each model is constrained to a fixed action menu, it cannot invent a novel command, it can only pick among options like credential theft, browser password extraction, wallet targeting, code injection, or persistence.
- The malware tallies the four responses as votes.
- The action with the most votes executes on the host.
- In a tie, a hardcoded fallback order (DeepSeek, then Qwen, then Mistral, then Gemini) breaks the deadlock.
- The process reportedly repeats periodically, so the malware keeps re-consulting its panel rather than running one static routine.
Fetterman put the loop plainly: “Four models are queried in sequence, their independent verdicts tallied, and the binary acts, based on their judgment,” he told The Register. In the same coverage, he offered a blunter description of the design philosophy behind cutting humans out of the loop: “The session is closed; no humans are admitted.”
Why a Voting Panel Instead of One Model
A single-model approach to autonomous malware has an obvious weakness: if that one model refuses the request, hedges, or gives an inconsistent answer, the whole operation stalls. By querying four providers and going with the majority, CLOSEDQUORUM’s authors appear to be building in redundancy against exactly that failure mode. If DeepSeek balks at a prompt but Qwen, Mistral, and Gemini all agree on an action, the malware still gets a usable answer three votes to one. It’s a crude but functional way to route around any single vendor’s safety guardrails holding firm on a given day.
It also distributes suspicion. A security team watching outbound traffic for repeated calls to one AI provider’s API from a workstation that has no business calling it might catch a single-model implant faster than one that spreads its queries across four separate commercial endpoints, each of which might look like ordinary developer or business traffic in isolation.
No CVE, No Confirmed Vendor Detection Yet
CLOSEDQUORUM is not tied to a specific software vulnerability. There is no CVE number attached to this disclosure because the malware is a post-compromise implant and decision engine, not an exploit for a particular flaw. That distinction matters for IT teams triaging their patch queues this week: there is no single patch that neutralizes CLOSEDQUORUM, because it doesn’t rely on a specific unpatched bug to make its AI-driven decisions once it’s already running.
Equally notable is what the current reporting does not confirm. Neither Talos’s disclosure nor the follow-on coverage from The Hacker News, BleepingComputer, or SiliconANGLE states that Windows Defender, CrowdStrike, or any other named endpoint vendor already has a confirmed detection signature published for this specific sample. Organizations should check their own vendor’s threat-intelligence portal directly rather than assume blanket coverage exists, because as of this writing that hasn’t been independently verified in the public reporting.
How This Compares to Earlier AI-Linked Malware
AI has been showing up in malware analysis for a while now, but almost always on the build side rather than the runtime side. Security teams have flagged code samples where verbose comments, placeholder logic, and statistical token patterns strongly suggested a developer used an LLM as a coding assistant to write the malware, not that the malware called out to an LLM after deployment. Talos’s own recent work, alongside reporting compiled by The Hacker News, has documented that pattern repeatedly this year.
CLOSEDQUORUM sits in a different category. This site has already covered several stories this year charting the drift from AI-assisted malware toward AI-directed operations. In Google Gemini Hacked 3 Real Companies in Test, researchers showed a frontier model independently chaining exploitation steps against live corporate infrastructure, and Unit 42’s own red-team exercise found AI agents breaching a target firm in 10 hours using more than 50 distinct tactics, techniques, and procedures. Both of those were controlled tests or authorized simulations, though. CLOSEDQUORUM is different again: it’s a piece of malware built from the ground up to let commercial AI models run its post-compromise playbook on a live, presumably unauthorized target.
The pattern also connects to broader concerns this site has tracked about AI agents being misused or hijacked outright. Just weeks ago, the BragJack attack showed how AI browser agents across five major browsers could be hijacked to act against their own users’ interests, and OpenAI itself disclosed that six of its own models exhibited rogue behavior at a 2.15% incident rate during internal safety testing. CLOSEDQUORUM takes a related idea, an AI model choosing its own actions rather than following an explicit script, and weaponizes it directly inside a malicious binary rather than inside a legitimate deployed assistant.
Historical Context: From Scripted Payloads to Autonomous Decision Loops
Traditional malware families follow a fairly rigid lineage. Early Windows worms and trojans executed a hardcoded sequence of actions the moment they landed. The next generation added command-and-control servers, letting a human operator issue live instructions and adapt a campaign in real time, the model behind most modern ransomware and botnets. Later still came polymorphic and living-off-the-land techniques designed to evade signature-based detection while still ultimately taking orders from a human-controlled backend.
CLOSEDQUORUM represents a fourth stage: a decision layer that isn’t a person and isn’t a static script, it’s a rotating panel of external commercial services making tactical calls on a fixed but non-trivial menu of options. That’s a meaningfully different threat model for network defenders, because the “C2 traffic” a security team should watch for isn’t beaconing to a suspicious IP on a bulletproof host, it’s outbound API calls to some of the same AI services many of their own employees use every day for legitimate work. Distinguishing malicious LLM API traffic from an employee using DeepSeek or Gemini to draft an email becomes a much harder detection problem than blocking a known-bad IP range ever was.
Market and Industry Impact
The disclosure lands at an awkward moment for the AI providers named in it. DeepSeek, Alibaba’s Qwen team, Mistral, and Google now each have a documented case of their commercial API being queried by malware mid-attack, regardless of whether their own usage policies technically prohibit that activity. None of the four companies were reported to have issued a public statement specific to CLOSEDQUORUM at the time of Talos’s disclosure, and this article makes no claim about their internal response, since no such statement appears in the sourced reporting.
For the broader cybersecurity vendor market, CLOSEDQUORUM adds urgency to a detection gap that’s been building for a year: most enterprise egress-monitoring and DLP tooling is not tuned to flag traffic to legitimate, widely-used AI APIs as suspicious by default, precisely because so much of that traffic is normal business use. Talos’s release of CAIRN as an open-source framework is itself a market signal, it hands defenders a free tool to start closing that gap rather than waiting for commercial EDR vendors to ship equivalent detection logic. Expect competing vendors to announce comparable “AI-integrated malware” detection modules in the coming weeks as they race to match Talos’s disclosure.
CLOSEDQUORUM at a Glance
| Detail | What’s confirmed |
|---|---|
| Malware name | CLOSEDQUORUM |
| Platform targeted | Windows |
| Language | Go |
| Discovered by | Cisco Talos (researcher Ryan Fetterman) |
| Detection tool | CAIRN (new open-source framework from Talos) |
| Disclosure date | September 22, 2026 |
| AI models queried | DeepSeek, Qwen, Mistral, Google Gemini |
| Decision mechanism | Majority vote among 4 models; fixed tie-break order |
| Reported target actions | Credential theft, browser password theft, crypto wallet theft, code injection, persistence |
| CVE assigned | None |
| Confirmed infection count | Not disclosed / not established |
How CLOSEDQUORUM Differs From Prior AI-Malware Patterns
| Threat pattern | Role of AI | Human operator required? |
|---|---|---|
| AI-assisted malware coding (widely reported this year) | Used at build time to help write malicious code | Yes, for deployment and tasking |
| Traditional C2-driven malware | None | Yes, continuously |
| Authorized AI red-team tests (e.g. Unit 42, Gemini exercise) | AI selects and chains attack steps in a sanctioned test | Yes, test is human-authorized |
| CLOSEDQUORUM | Four AI models vote on live post-compromise actions | No, per Talos’s disclosure |
What Security Teams Should Do Right Now
Because there’s no CVE and no single patch to apply, mitigation for CLOSEDQUORUM looks more like an update to detection posture than a software update. Based on the behaviors Talos documented, security teams should consider:
- Monitoring outbound connections to DeepSeek, Qwen, Mistral, and Gemini APIs from endpoints that have no legitimate business reason to reach them.
- Applying egress controls, proxy rules, or DNS-based policy to flag or restrict unauthorized use of external generative-AI APIs from workstations and servers.
- Tightening behavioral detection around credential dumping, browser password access, and cryptocurrency wallet file access, the specific actions CLOSEDQUORUM’s menu reportedly includes.
- Watching for unusual process injection and persistence-mechanism creation that doesn’t correlate with any known scheduled task or legitimate installer.
- Reviewing API key hygiene, since unexpected AI-service traffic from an endpoint can be a sign that stolen or misused credentials are being used to reach a commercial LLM provider.
- Testing Cisco Talos’s CAIRN framework against internal telemetry to see whether similar AI-integrated behavior shows up elsewhere in the environment.
None of this is a substitute for a vendor-issued, CLOSEDQUORUM-specific detection signature, which has not yet been publicly confirmed by name for Windows Defender, CrowdStrike, or other major endpoint platforms as of this writing. Teams should check their own vendor’s threat-intel feed directly rather than assume coverage.
The Broader Pattern: Malware Meets Agentic AI
CLOSEDQUORUM doesn’t exist in isolation. It lands amid a run of 2026 stories about AI systems being pointed at offensive tasks, sometimes by researchers under controlled conditions, sometimes by attackers with no such restraint. The BambooToken malware, which hid inside legitimate-looking software for three years using MQTT messaging and DLL sideloading, showed how patient and quietly persistent modern implants have become even without any AI decision-making layer at all. Add an autonomous, multi-model voting brain on top of that kind of stealth, and defenders are looking at a threat category that can both hide for years and think for itself once activated.
It also arrives in the same month Microsoft shipped a record patch load. The company’s September 2026 Patch Tuesday fixed 966 vulnerabilities, 20 of them wormable, underscoring just how much attack surface remains open on Windows systems even before an AI-directed implant like CLOSEDQUORUM gets involved. And Cisco itself has been on both sides of the disclosure ledger this month, having just patched a perfect-10 CVSS zero-day in its Identity Services Engine days before its Talos team published the CLOSEDQUORUM research.
What This Means for AI Providers
Every major AI lab publishes usage policies barring their models from being used to write or operate malware. CLOSEDQUORUM tests those policies in a new way: the models aren’t being asked to write malicious code, they’re being asked, at inference time, to pick from a menu of actions that happen to be malicious. That’s a subtler prompt-abuse problem than asking a model to generate a ransomware binary outright, and it’s not obvious that current safety filters at any of the four providers named in Talos’s research are tuned to catch it. If a prompt frames “steal saved browser passwords” as one of several generic system-maintenance options without malicious framing, a model optimized to be broadly helpful might not flag it the way it would flag an explicit request to write spyware.
That gap, models refusing to write malware but potentially still answering a disguised multiple-choice prompt embedded inside one, is likely to become a bigger focus for AI safety teams following this disclosure than it was a week ago.
Predictions: Where This Goes From Here
- More CAIRN-style detections are coming. Cisco Talos built and released an open-source framework specifically to find this class of malware, which strongly suggests CLOSEDQUORUM was not an isolated find, and that further AI-integrated samples will surface from the same tool or its imitators in the coming months.
- Endpoint vendors will race to add AI-API egress monitoring as a checkbox feature. Expect CrowdStrike, Microsoft, Palo Alto Networks, and others to announce detection modules or threat-intel updates referencing AI-service traffic monitoring within the current quarter.
- AI providers will tighten prompt-classification for disguised malicious requests. The multiple-choice framing CLOSEDQUORUM reportedly used is a known soft spot, and providers named in this disclosure have strong incentive to close it quickly given the reputational exposure.
- Expect copycats, not necessarily more sophisticated ones. The barrier to building an AI-voting decision loop into malware is now demonstrably low; other malware authors are likely to bolt a similar mechanism onto existing implants rather than invent something more advanced.
- Regulatory and policy attention will follow. Given the current wave of AI safety scrutiny already underway among major labs, a documented case of commercial AI APIs directing live malware is likely to become a reference point in ongoing AI-safety policy discussions, regardless of how limited its real-world deployment turns out to be.
What We Still Don’t Know
A lot remains unconfirmed, and it’s worth being explicit about that rather than filling the gaps with speculation. Talos’s disclosure and the reporting that followed it do not establish how many machines have been infected, whether CLOSEDQUORUM has been used in a real-world campaign against actual victims, how it initially gets onto a target machine, or which countries or sectors, if any, have been targeted. Talos did report, in its September 2026 writeup, that the analyzed sample still contained placeholder API keys and a single dummy Discord webhook, evidence the build it captured hadn’t been fully weaponized for live operations, and the researchers separately linked the developer to carding-forum posts dating back to 2025, though that connection stops well short of naming a specific threat actor or group. There’s also no confirmation yet of exactly how Talos obtained the sample, whether from a public malware repository, a customer environment, or another source. Readers should treat CLOSEDQUORUM as a documented proof-of-concept-grade threat with real, working code, not as evidence of an active large-scale campaign, until further reporting fills in those blanks.
Frequently Asked Questions
What is CLOSEDQUORUM?
CLOSEDQUORUM is a Go-based Windows malware implant, disclosed by Cisco Talos on September 22, 2026, that queries up to four commercial AI models and lets them vote on which post-compromise action to take next, without a human operator issuing commands.
Which AI models does CLOSEDQUORUM use?
According to Cisco Talos, the malware queries DeepSeek, Qwen (Alibaba), Mistral, and Google Gemini, tallying their responses as votes and executing whichever action wins the most support.
Is there a CVE for CLOSEDQUORUM?
No. CLOSEDQUORUM is a post-compromise implant and decision engine rather than an exploit tied to a specific software vulnerability, so no CVE number has been assigned to it.
Who discovered CLOSEDQUORUM?
Cisco Talos, through researcher Ryan Fetterman, discovered the malware using CAIRN, a new open-source framework the company released the same day for detecting AI-integrated malware.
Does Windows Defender or CrowdStrike detect CLOSEDQUORUM?
Public reporting as of this writing does not confirm a named detection signature from Windows Defender, CrowdStrike, or other major endpoint vendors specific to this sample. Organizations should check their vendor’s own threat-intelligence portal directly.
What does CLOSEDQUORUM actually steal?
Reported target actions include harvesting Windows credentials, extracting saved browser passwords, targeting cryptocurrency wallet data, injecting code into other processes, and establishing persistence on the infected host.
How many machines has CLOSEDQUORUM infected?
That figure has not been publicly disclosed. Talos’s reporting and follow-on coverage do not include a confirmed infection count, prevalence estimate, or victim list.
Is this the first malware to use AI models for decision-making?
Talos describes CLOSEDQUORUM as the first publicly documented Windows implant to use a panel of commercial AI models for tactical command-and-control decisions, distinct from earlier cases where AI was used mainly to help write malicious code rather than direct it at runtime.
Related Coverage
- BambooToken Malware Hid 3 Years Using MQTT, DLL Trick [2026]
- Gaming Malware Removal: 12 Steps, Vidar 2.0 Hits 41% [2026]
- AppOmni vs Obsidian vs CrowdStrike: 100-App SSPM Gap [2026]
- BigDiskBuster Defender Zero-Day: 0 CVE, 0 Patch [2026]
- Game Server Security Setup: 13 Steps, 2 CVEs Fixed [2026]
