Malware Now Lets Four AI Models Vote On The Attack

Analysis

Cisco's Talos threat-intelligence unit disclosed a malware sample it calls CLOSEDQUORUM on September 22, describing it as the first publicly documented Windows implant to delegate command-and-control decisions to a panel of commercial AI models rather than to a human operator. The sample is a 16.4MB, 64-bit Windows executable compiled in Go.

How The Malware Actually Decides What To Do

CLOSEDQUORUM sends host context -- details about the infected machine -- to up to four commercial AI providers: DeepSeek, Qwen, Mistral and Google Gemini. Each model is prompted as an "advanced malware strategist" and asked to pick the next move from a constrained menu that includes credential theft, browser-stored password harvesting, cryptocurrency wallet theft, code injection and persistence mechanisms. Each of the four models returns a structured choice, and the implant resolves the four votes through simple plurality -- whichever option gets the most votes wins. That design means the malware keeps operating even if one provider blocks the request, rate-limits it, or refuses on safety grounds; it just needs a majority of the panel to cooperate.

Talos's Answer: A Toolkit, Not Just A Warning

Alongside the CLOSEDQUORUM disclosure, Talos open-sourced CAIRN (Cognitive Artifact Intelligence Research Network), a research toolkit built specifically to hunt, classify and track AI-integrated malware. CAIRN searches for the fingerprints AI-driven malware leaves behind -- prompt templates, provider API-key prefixes, jailbreak terms, orchestration logic -- without downloading or executing the actual malicious binary, a metadata-first approach that lets researchers scan at scale without the operational risk of running live malware samples.

This places Talos in a different competitive position than most cybersecurity vendors currently selling AI-security products: rather than pitching a product built for a hypothetical threat, Cisco is releasing free tooling built around a threat it just discovered itself, in the same disclosure. That's a stronger credibility signal than most vendor claims in this category, similar in spirit to Microsoft's EvilTokens takedown earlier this week, which paired a real enforcement action with named arrests rather than only a warning.

Why The Four-Provider Design Matters More Than It Looks

The plurality-vote architecture is the detail worth sitting with. A single-model dependency would make malware like this trivially killable -- one provider adds a refusal pattern for the specific prompt structure, and the malware goes dark. By spreading decision-making across four independent commercial providers with different safety training, different refusal thresholds and different content policies, CLOSEDQUORUM's authors built in redundancy against exactly the kind of provider-side mitigation that would otherwise be the fastest fix. It's the malware equivalent of a distributed system designed for fault tolerance, applied to evading AI safety guardrails specifically.

For AI labs, this creates an uncomfortable shared-responsibility problem: no single provider's safety team can unilaterally solve this, because the malware doesn't depend on any one of them individually. DeepSeek, Qwen, Mistral and Google would each need to independently detect and block this exact use pattern, or coordinate on shared threat intelligence about it -- something the industry has talked about wanting for years but rarely does at the speed adversaries iterate.

What to watch: whether any of the four named providers confirm they've since blocked the specific prompt pattern CLOSEDQUORUM uses, and whether Talos or another researcher finds this design pattern reused in an actual in-the-wild campaign in the coming months -- the gap between a documented proof-of-concept and a live incident is usually measured in weeks, not years, once the technique is public.