Cisco Talos has documented a Windows malware prototype called CLOSEDQUORUM that introduces an unusual approach to command-and-control: instead of receiving every instruction from a human attacker or dedicated C2 server, the malware can ask multiple commercial AI models what it should do next.

The malware queries up to four large language models:

  • DeepSeek
  • Qwen
  • Mistral
  • Google Gemini

Each model receives information about the compromised Windows host along with a predefined list of possible actions.

The models independently select an action, the malware counts their votes, and the option receiving the most support is executed.

In effect, the malware creates an AI “quorum” to decide the next stage of its operation.

This is significantly different from simply using AI to generate malware code or phishing messages.

Here, AI becomes part of the malware's runtime decision-making architecture.

How does the AI voting system work?

CLOSEDQUORUM gathers basic information about the infected machine, including details such as:

  • computer name;
  • Windows version; and
  • whether the process has administrator privileges.

It then sends that information to the configured AI services along with a constrained set of possible actions.

The available choices identified by Talos include:

Steal

Collect credentials and cryptocurrency-related information.

Inject

Execute malicious code inside another process.

Persist

Establish mechanisms that allow the malware to survive system restarts.

Move

A placeholder for potential lateral-movement functionality.

The publicly analyzed version does not contain implemented functionality behind the move option.

The AI models are therefore not given unlimited authority to invent arbitrary actions.

They operate inside a decision space established by the malware developer.

That distinction is important.

CLOSEDQUORUM is not an AI system independently inventing an entire attack strategy from scratch.

It is malware whose developer has delegated tactical choices between predefined capabilities to external AI models.

Majority vote determines the malware's next move

Each model must respond using a specific structured format.

Responses that do not conform to the expected format are discarded.

The malware then compares the valid recommendations.

The action receiving the most votes wins.

Where there is a tie, the models are given a priority order, with DeepSeek receiving the highest tie-breaking priority, followed by Qwen, Mistral, and Gemini.

If none of the models produces a usable response, the malware does not simply choose an action randomly.

Instead, it waits and tries again later.

This design shows that the developer was thinking about AI reliability rather than assuming every LLM response would be usable.

Why is this different from traditional command-and-control?

Traditional malware usually depends on an attacker-controlled command-and-control system.

A compromised endpoint periodically contacts infrastructure operated by the attacker and receives instructions such as:

  • download this file;
  • execute this command;
  • steal these credentials;
  • establish persistence; or
  • move to another system.

That creates operational dependencies.

The attacker needs functioning infrastructure and, in many cases, someone or something on the other end making decisions.

CLOSEDQUORUM attempts to move part of that decision process to publicly available AI services.

Once deployed with valid API credentials, the malware could theoretically continue choosing actions without requiring the attacker to remain actively involved.

That represents what Talos describes as effort displacement.

Instead of AI merely making an attacker faster, it allows the attacker to delegate part of the attack lifecycle entirely.

The malware can steal significant credentials

If the AI quorum selects the steal action, CLOSEDQUORUM launches several credential-theft operations in parallel.

Talos found capabilities designed to:

  • dump LSASS memory;
  • steal saved Chrome credentials;
  • steal saved Microsoft Edge credentials;
  • steal Firefox credentials; and
  • collect cryptocurrency wallet information.

Wallet targets include:

  • MetaMask;
  • Exodus; and
  • Ethereum-related data.

LSASS access is particularly significant because Windows' Local Security Authority Subsystem Service may contain credentials or authentication material useful for additional compromise.

The malware therefore does not merely collect low-value browser history or system information.

Its theft capability is focused on credentials that could support account takeover, financial theft, or additional access.

Process injection provides another attack capability

If the models vote for inject, CLOSEDQUORUM can execute malicious code inside another process.

The malware supports techniques including:

  • Early Bird APC injection; and
  • process hollowing.

Process injection is frequently used to conceal malicious execution inside an otherwise legitimate-looking Windows process.

From a defensive perspective, the important signal is therefore not only the malware executable itself.

Security teams should monitor unexpected relationships between processes, unusual suspended process creation, memory manipulation, and code execution occurring inside processes that normally would not exhibit such behavior.

Persistence is deliberately redundant

If persist wins the vote, CLOSEDQUORUM establishes multiple persistence mechanisms rather than relying on a single technique.

Talos identified three methods:

  • a Registry Run key;
  • a scheduled task; and
  • a permanent WMI event subscription.

The malware uses Windows Update-themed naming to make some of these artifacts appear less suspicious.

For example, it creates a value named:

WindowsUpdate

under the current user's Registry Run location.

It can also create a WMI-based persistence mechanism designed to launch the malware repeatedly.

Using several independent persistence mechanisms increases the likelihood that the malware survives partial remediation.

A defender might remove the Registry entry while leaving the scheduled task or WMI subscription intact.

This is why incident response should examine the entire persistence landscape rather than deleting only the first suspicious artifact discovered.

AI decisions are still visible to the attacker

Despite its autonomous design, CLOSEDQUORUM does not completely remove the attacker from visibility.

Before executing an AI-selected action, the malware sends the decision and the models' reasoning to a Discord channel through a webhook.

The same Discord infrastructure is also used for stolen data.

This means the operator can observe what the AI models decided even though they do not need to manually issue every command.

The architecture is therefore better understood as:

autonomous tactical execution with human visibility

rather than total independence from an attacker.

Stolen information is encrypted before exfiltration

Before sending stolen data, the malware copies it into:

C:\Windows\Temp\

It then encrypts the material and breaks it into small chunks before sending the pieces through Discord.

Talos observed approximately 1,900-byte chunks transmitted at roughly one piece per second.

This design likely helps keep individual messages within service limitations while providing a convenient exfiltration channel through legitimate infrastructure.

Attackers increasingly abuse services such as Discord, Telegram, GitHub, cloud-storage platforms, and SaaS APIs because defenders cannot simply block every connection to major legitimate services without creating operational problems.

CLOSEDQUORUM does not appear fully operational in its public form

This point deserves emphasis.

The sample analyzed publicly contains placeholder values for:

  • LLM API keys; and
  • the Discord webhook.

Therefore, the publicly available binary cannot actually contact the AI services or send stolen information to an attacker.

Talos believes working builds could have operator-specific API credentials and Discord webhooks injected during compilation.

However, researchers have not confirmed real-world deployment of such a functional build.

This means CLOSEDQUORUM should currently be viewed primarily as an important proof of concept or developmental malware architecture, rather than evidence of a widespread active campaign.

That distinction matters.

AI-related cybersecurity reporting has enough enthusiasm without turning every experimental binary into Skynet before lunch.

There are indications of a criminal-development background

While Talos has not attributed CLOSEDQUORUM to a known threat group, artifacts associated with the binary allowed researchers to connect its developer with posts on criminal forums involving carding activity dating back to 2025.

Carding refers to criminal activity involving stolen payment-card data.

This connection suggests the malware was not necessarily created purely as academic experimentation.

However, the research does not establish that CLOSEDQUORUM itself has been used operationally to steal payment cards or conduct attacks.

The distinction between developer background and confirmed malware deployment should be maintained.

AI-based command-and-control creates advantages for attackers

From an offensive perspective, delegating tactical decisions to AI could provide several benefits.

Reduced operator workload

One attacker could potentially supervise significantly more compromised systems if AI handles routine decisions.

Continuous operation

An AI system does not need to sleep or actively monitor every infected machine.

Adaptive decision-making

Different compromised hosts could receive different actions based on system characteristics.

Reduced dependence on dedicated C2 logic

Instead of writing a large decision engine themselves, attackers can outsource reasoning to external models.

Scalability

An implant operating on many hosts could independently determine which systems are worth credential theft, persistence, or other actions.

The result could be malware that requires progressively less human attention after deployment.

But using commercial AI services also creates weaknesses

CLOSEDQUORUM's architecture introduces several dependencies attackers do not control.

AI providers can:

  • revoke API keys;
  • suspend abusive accounts;
  • rate-limit requests;
  • change model behavior;
  • reject malicious prompts;
  • alter API formats; or
  • retain telemetry useful for investigation.

Network defenders may also detect unusual API use.

A random Windows executable contacting four different AI providers within minutes should already be somewhat eyebrow-raising.

If the same process subsequently touches LSASS and creates WMI persistence, the eyebrows can safely remain raised.

Blocking AI domains is not a realistic detection strategy

Talos specifically argues that defenders should focus on behavioral combinations rather than simply blocking AI-service domains.

Connections to:

  • Gemini;
  • DeepSeek;
  • Mistral;
  • OpenRouter;
  • Discord; or
  • similar services

may be perfectly legitimate in modern enterprise environments.

The suspicious behavior emerges when those communications occur alongside endpoint activity such as:

  • LSASS memory access;
  • browser credential theft;
  • process injection;
  • WMI persistence;
  • scheduled-task creation; and
  • repeated Discord webhook communication.

The correlation is more valuable than any single indicator.

Multiple AI-provider requests can itself become a signal

One particularly interesting behavioral indicator is simultaneous or near-simultaneous traffic to several AI providers from the same executable.

Most legitimate enterprise applications use one AI provider or a deliberately configured service layer.

An unknown Windows binary contacting:

DeepSeek + Qwen + Mistral + Gemini

within a short interval is considerably less ordinary.

Security teams could therefore consider monitoring for unexpected multi-provider AI API usage, particularly from endpoints or applications with no documented AI functionality.

This is a new category of telemetry defenders may increasingly need to understand.

TLS inspection may expose malicious prompts

Talos also published a Snort rule designed to recognize CLOSEDQUORUM's AI prompts.

However, because communication with commercial AI services normally occurs over HTTPS, detecting the actual prompt contents would typically require TLS inspection or visibility from the AI provider itself.

Organizations without decrypted network visibility can still use endpoint and metadata signals.

For example:

unknown process → multiple AI API endpoints → LSASS access → Discord webhook → persistence creation

may provide a strong behavioral detection sequence even when the HTTPS payload remains encrypted.

Talos developed CAIRN specifically to hunt AI-integrated malware

CLOSEDQUORUM was discovered through a new Cisco Talos research framework called CAIRN, short for Cognitive Artifact Intelligence Research Network.

CAIRN is designed to identify malware containing indicators of AI integration.

Researchers look for what Talos calls cognitive artifacts, such as:

  • embedded prompts;
  • AI-provider API endpoints;
  • model orchestration code;
  • model-specific request structures; and
  • instructions designed for AI systems.

This reflects an emerging challenge for malware analysis.

Historically, analysts searched binaries for:

  • C2 addresses;
  • cryptographic routines;
  • persistence mechanisms; and
  • malware-family signatures.

AI-integrated malware introduces additional artifacts related to model communication and reasoning.

CLOSEDQUORUM is part of a broader trend

CLOSEDQUORUM is not the first example of malware incorporating AI.

In 2025, Ukraine's CERT-UA documented LAMEHUG, malware that used an AI model to generate commands for predefined objectives.

The difference is subtle but important.

LAMEHUG used AI to determine how to perform a requested activity.

CLOSEDQUORUM uses AI to decide which activity should happen next.

That represents another step toward delegating more of the decision-making process itself.

The direction of travel is therefore worth watching even if CLOSEDQUORUM is not yet operationally mature.

The human operator remains important

It would be premature to conclude that AI has made cybercriminals unnecessary.

Humans still appear necessary to:

  • develop the malware;
  • select victims;
  • distribute the implant;
  • provide valid API keys;
  • configure exfiltration infrastructure;
  • monetize stolen credentials; and
  • manage the wider criminal operation.

What AI changes is how much ongoing attention each infected system might require.

This is similar to automation elsewhere in cybersecurity.

The goal is not necessarily to eliminate humans entirely.

It is to allow one human to control significantly more activity.

Defenders should focus on behavior, not whether malware calls itself “AI”

The arrival of AI-enabled malware should not cause organizations to abandon established defensive practices.

CLOSEDQUORUM still performs recognizable malicious actions.

It:

  • accesses LSASS;
  • steals browser credentials;
  • accesses cryptocurrency wallets;
  • injects processes;
  • creates persistence;
  • writes temporary files; and
  • exfiltrates information.

Those behaviors remain detectable regardless of whether the decision to perform them came from a criminal sitting at a keyboard or four language models holding a tiny digital committee meeting.

Endpoint monitoring, least privilege, credential protection, application control, network visibility, and behavioral correlation therefore remain highly relevant.

The broader cybersecurity lesson

CLOSEDQUORUM is important not because it represents an unstoppable new form of malware.

It does not.

Its public implementation is incomplete, dependent on external AI providers, and has not been confirmed in active attacks.

Its importance lies in demonstrating a plausible architecture for reducing the human decision-making required after compromise.

The malware's loop can effectively become:

collect host context → query multiple AI models → vote → choose action → execute → report result → repeat

That architecture can theoretically continue while the attacker is offline.

The immediate threat is therefore not that four AI models have suddenly become cybercriminal masterminds.

The more realistic concern is that attackers can increasingly delegate repetitive tactical decisions to AI and supervise larger numbers of compromised systems with less effort.

AI's most consequential impact on malware may not be creating entirely new attacks. It may be removing the human bottleneck from attacks we already know how to perform.

CLOSEDQUORUM provides an early example of what that future could look like.

And perhaps the strangest part is that malware development has apparently reached the stage where even malicious software refuses to make an important decision without forming a committee first.

A Windows malware called CLOSEDQUORUM is built to take orders from a vote of up to four AI models instead of an attacker's server, Cisco Talos said on September 22. The models can choose to steal Windows credentials, saved browser passwords, and crypto wallet data. Talos has not seen this setup work from start to finish, and the public version of the malware does not work as it is.

Source: This Windows Malware is Built to Let Up to Four AI Models Vote on Its Next Move via The Hacker News — published 23 Sep 2026.