Cisco Talos has documented a Windows malware prototype that delegates post-compromise decisions to a panel of large language models. It is not confirmed to have been deployed in the wild, but it shows how AI could remove the human operator from parts of an intrusion.
Key takeaways
- CLOSEDQUORUM can query DeepSeek, Qwen, Mistral and Google Gemini and tally their choices for the next action.
- The models choose only among capabilities already implemented in the malware.
- Cisco Talos has not confirmed real-world deployment.
- Defenders can hunt for AI-related artifacts such as provider endpoints, prompt templates and API strings.
From AI-assisted attacks to AI decision loops
Cybersecurity researchers have spent the past few years debating whether generative AI will merely make attackers faster or fundamentally change how attacks operate. CLOSEDQUORUM is an unusually concrete example of the second possibility.
Cisco Talos disclosed CLOSEDQUORUM on 22 September 2026 after finding it through CAIRN, its open-source toolkit for identifying and tracking AI-integrated malware. Talos describes the sample as a Windows implant written in Go that can query four AI services—DeepSeek, Qwen, Mistral and Google Gemini—and use their votes to choose its next post-compromise action.
How the voting mechanism works
Traditional malware normally receives instructions from a command-and-control server operated by a human or follows a fixed sequence coded in advance. CLOSEDQUORUM instead collects information about the compromised machine, presents that context to multiple language models and asks them to choose among a constrained set of actions.
The analysed sample includes choices such as stealing credentials and cryptocurrency-wallet data, establishing persistence and injecting code. A lateral-movement option exists in the decision schema, although the analysed build does not implement it.
According to Talos, the models are queried sequentially and their decisions are tallied. If the vote is tied, the malware uses a defined priority order. The models choose from capabilities already implemented by the malware rather than receiving unrestricted control.
An important caveat
Talos says it has not confirmed deployment of CLOSEDQUORUM in real-world attacks. The analysed build contained placeholder API credentials and a dummy Discord webhook, so the sample may be developmental or experimental. BleepingComputer independently reported the same limitation.
Why this matters
The main risk is not that this single sample is already a major threat. It is the design pattern. Delegating tactical decisions to AI services could reduce the amount of operator attention needed after compromise. At the same time, dependence on external AI APIs introduces weaknesses including rate limits, unavailable services, malformed model output and provider-side monitoring.
CAIRN and the defender’s perspective
Talos released CAIRN alongside the research. Instead of looking only for conventional malware signatures, CAIRN searches for “cognitive artifacts”: prompt templates, AI-provider endpoints, API-related strings, jailbreak terminology and other traces left when malware integrates AI systems.
What IT and security teams should do
AI-service access should be treated as part of the attack surface. Organisations should monitor unusual outbound connections to AI APIs, protect API credentials and developer secrets, restrict unnecessary egress from endpoints and servers, and correlate endpoint telemetry with cloud and identity logs.
Existing controls—least privilege, credential protection, application control, EDR and network segmentation—remain central because AI does not remove the attacker’s need to obtain execution and access valuable data.
Critical perspective
CLOSEDQUORUM is evidence of a plausible direction, not proof that autonomous AI malware is already widespread. The strongest conclusion supported by the available evidence is that attackers can embed external LLMs into malware decision loops, while defenders can also hunt for the artifacts those integrations create.
Sources
- Cisco Talos — The Closed Quorum, 22 September 2026.
- Cisco Talos — Introducing CAIRN, 22 September 2026.
- BleepingComputer — New ClosedQuorum Windows malware uses AI for attack decisions, 22 September 2026.
Leave a Reply