Malware That Lets Four AI Models Vote on Its Next Move Alarms Security Researchers

Security researchers at Cisco's Talos threat-intelligence group say they have found the first publicly documented piece of Windows malware that hands its tactical decisions to a panel of commercial artificial intelligence models rather than to a human operator. The implant, which Talos named CLOSEDQUORUM, queries up to four AI services in sequence and acts on whichever move wins a vote, removing the attacker from the loop for large stretches of a compromise.

Talos disclosed the implant on Tuesday in a research writeup describing the "closed quorum" architecture, publishing it alongside a new open-source detection toolkit built specifically to hunt this category of threat. The company said it has not confirmed that the malware has been used against real victims, and the publicly recovered sample contains placeholder credentials that leave it non-functional out of the box. Talos also said it has not determined who built the tool.

The numbers

CLOSEDQUORUM is a 16.4-megabyte, 64-bit Windows executable written in Go with embedded C code that makes direct system calls, according to Talos's analysis. Once running on a compromised machine, it queries four commercial large-language-model services — DeepSeek, Alibaba's Qwen, Mistral and Google's Gemini — and asks each one to choose the implant's next move from a defined menu of options. The action that receives the most votes is executed; if the vote ties, DeepSeek's answer wins by priority order. Talos researcher Ryan Fetterman described the design bluntly: "The session is closed; no humans are admitted. Four models are queried in sequence, their independent verdicts tallied, and the binary acts, based on their judgment."

The capabilities Talos catalogued are conventional for credential-theft malware — dumping login secrets from the Windows LSASS process, lifting saved passwords out of Chrome, Edge and Firefox, and pulling data from cryptocurrency wallets such as MetaMask and Exodus, a technique tracked by the MITRE ATT&CK catalog of credential-dumping methods. It establishes persistence through the Windows registry, scheduled tasks and WMI subscriptions, and exfiltrates stolen data in small encrypted chunks sent through Discord webhooks. What is unconventional is that none of those steps requires a traditional command-and-control server; the decision-making layer lives inside four AI companies' public APIs.

How the quorum works, and why it matters

Talos frames the malware as an example of "effort displacement": rather than making a human attacker faster, the architecture removes the operator entirely from a phase of the intrusion that previously required constant attention. Because the implant can query the AI panel on its own schedule, it can keep operating even when no human is available to issue instructions, a shift the firm has described as part of a broader trend it has watched accelerate over roughly a year, moving from optional AI-assist features bolted onto old malware toward fully autonomous, multi-model orchestration. As Fetterman put it in Talos's companion research post, announcing the new detection framework, "there is an autonomy escalation arc, and it is changing fast."

"The session is closed; no humans are admitted. Four models are queried in sequence, their independent verdicts tallied, and the binary acts, based on their judgment." — Ryan Fetterman, Cisco Talos

The design also has a built-in weakness that Talos flagged: commercial AI providers maintain safety guardrails that can cause a model to refuse a request that looks malicious or return unusable output. CLOSEDQUORUM's authors appear to have anticipated that by spreading the vote across four separate providers, so that if one service declines to answer, the others can still produce a majority. Security teams that reported independently on the sample, including coverage from The Hacker News and analysis published by Help Net Security, noted that this redundancy against guardrails is itself a novel piece of tradecraft, separate from the malware's theft functions.

Who is affected

The immediate audience for the disclosure is corporate security teams running Windows fleets, who now have a new behavioral category to watch for: outbound traffic to multiple AI-model APIs from a single endpoint, followed by credential-dumping or wallet-access activity. Talos built its new toolkit, called CAIRN, for exactly that hunting problem, arguing that AI-integrated malware leaves behind metadata markers — embedded prompts, API keys and jailbreak-style instructions — that can be spotted without reverse-engineering an entire binary.

There is a second, less direct set of parties implicated: DeepSeek, Alibaba, Mistral and Google, whose commercial AI products were queried by the implant without their knowledge or consent, in apparent violation of each company's usage policies. Talos's report does not indicate that any of the four providers had commented on the specific sample by the time of publication, and none of the companies has issued a public statement addressed to CLOSEDQUORUM. The episode nonetheless raises a question the AI industry has faced with growing frequency as generative tools proliferate: how providers detect and cut off automated abuse of their APIs by malicious software rather than by human users.

What happens next

Talos has released CAIRN as an open-source project so other researchers can classify and track AI-integrated malware samples as they appear, and the firm has said it expects the release itself to function as a signal to competing security vendors, several of which are likely to publish comparable detection modules for "AI-integrated malware" in the coming weeks. Because the recovered CLOSEDQUORUM sample was not fully weaponized, the more consequential question is whether a functional version surfaces in an actual intrusion, and whether other malware authors adopt the same multi-model voting approach now that Talos has published a technical description of how it works.

Additional reporting on the sample from outlets including Security Affairs has echoed Talos's caution that the discovery represents an early and limited proof of concept rather than an active campaign. For now, the malware exists chiefly as a demonstration that the architecture works — a preview, researchers say, of a category of threat that enterprise defenders have not previously had to build detections for.