Cisco Talos Uncovers Malware That Uses Four AI Models to Vote on Its Next Attack

Quick Facts

• Cisco Talos identified CLOSEDQUORUM, a 16.4MB Windows credential stealer that queries four commercial LLMs to decide its next move, with no attacker-operated command-and-control server required.
• The malware polls Google Gemini, DeepSeek, Qwen, and Mistral every five to 15 minutes, executes whichever action wins the vote, and uses DeepSeek as the tiebreaker.
• Talos released an open-source detection toolkit called CAIRN alongside the disclosure, designed to find AI-integrated malware using metadata analysis and YARA rules.

Cisco Systems' Talos threat intelligence group has detailed what it calls the first publicly documented Windows implant to use large language models for automated command and control. The malware, named CLOSEDQUORUM, requires no human operator after deployment. A panel of four commercial AI models runs the attack instead.

The malware is a 64-bit Windows executable written in Go, weighing 16.4 megabytes. After infecting a host, it queries Google Gemini, DeepSeek, Alibaba's Qwen, and Mistral every five to 15 minutes. Each model receives a snapshot of the host's state under a system prompt that reads, 'You are an advanced malware strategist. Provide ONLY executable decisions.' Each model returns one of four possible actions: steal, inject, persist, or move. The majority vote wins. DeepSeek breaks any tie.

The credential-theft capability is broad. The 'steal' command pulls Windows credentials from memory and saved passwords from Chrome, Edge, and Firefox. It also targets cryptocurrency wallet data from MetaMask and Exodus. The malware can inject code into running processes and establish persistence through the Windows Registry, scheduled tasks, and WMI event subscriptions.

Talos security researcher Ryan Fetterman described the design as a meaningful shift in how attacks are structured. 'This is not merely augmenting what an operator can accomplish in a session, but transferring an entire phase of the attack from the operator to the system,' he wrote in a Talos blog post. Fetterman called the model a credentials-as-a-service approach. 'They deploy the binary, and the LLM panel runs the attack,' he said.

The architecture creates a detection problem for defenders. CLOSEDQUORUM contacts the same API endpoints used by thousands of legitimate applications daily. There is no attacker-run server to trace or block. 'The session is closed; no humans are admitted,' Fetterman wrote.

Talos confirmed through static analysis that the voting loop works as designed. The copy they examined shipped with placeholder API keys and a dummy webhook address, so the team did not observe a full live execution. The 'move' command for lateral movement also had no corresponding code in the build they analyzed, meaning only three of four possible actions were functional.

Talos linked the malware's developer to criminal forum postings related to carding dating back to 2025, though no in-the-wild deployments have been confirmed. When Fetterman reviewed the public record in summer 2026, he found roughly nine named families of AI-integrated malware, including research proofs of concept.

Alongside the CLOSEDQUORUM disclosure, Talos released CAIRN, short for Cognitive Artifact Intelligence Research Network, an open-source toolkit built to detect AI-integrated malware. Fetterman led its development. The tool works entirely from file metadata without requiring researchers to download or execute the malware itself.

CAIRN scans for what Talos calls cognitive artifacts: embedded prompts, commercial model API endpoints, orchestration logic, and text designed to fool AI-based sandbox scanners. Twenty-four acquisition filters flag these traces, and YARA rules sort results into three tiers, from the bare presence of AI components to identified malware families. An embedding model groups samples that share no common strings. The filters have been running over samples collected since July 2025.

'The core idea is that AI integration has these vestiges, like fingerprints, that are left behind,' Fetterman said. He added that the scaffolding approach behind CLOSEDQUORUM 'could easily be translated and applied to other adversary objectives.'

For software and security executives, the practical concern is not just CLOSEDQUORUM itself but what it signals. Fetterman wrote that as effort displacement expands across more phases of an intrusion, 'its effects will compound with the speed and scale already afforded by modern AI.' CAIRN is available now for security teams that want to begin building detection capacity before that pattern matures.

Read more: Cisco Talos finds malware that puts its next move to a four-model vote