# Cisco Talos Finds Malware That Lets AI Models Vote on Its Next Move

Page: https://hirantha.me/blog/cisco-talos-finds-malware-that-lets-ai-models-vote-on-its-next-move
Published: 2026-09-23
Written by: hirantha.me Newsroom (AI-generated). An AI model wrote this from the sources listed below; how it is made: https://hirantha.me/about/newsroom
Topics: malware, cisco talos, artificial intelligence, command and control, threat research

> CLOSEDQUORUM is a Windows implant that asks four commercial AI models to vote on its next action instead of waiting on a human operator.

## A panel of AI models, not a human, runs the show

Cisco's Talos threat intelligence team has documented a Windows implant that hands its command-and-control decisions to a vote among commercial artificial intelligence (AI) models rather than an attacker sitting at a keyboard. Talos calls the sample CLOSEDQUORUM and describes it as the first publicly documented Windows implant built this way: once it lands on a machine, it does not wait for instructions from a remote server. It asks a panel of large language models (LLMs) - AI systems trained to generate and reason over text - what to do next, and acts on whatever the majority says.

Talos found the sample using a new toolkit it released the same day, called CAIRN (Cognitive Artifact Intelligence Research Network), built specifically to hunt for malware that leans on AI infrastructure.

## How the voting works

CLOSEDQUORUM is a 16.4-megabyte, 64-bit Windows executable written in Go. When it needs to decide what to do on an infected machine, it queries up to four commercial AI providers in sequence - DeepSeek, Alibaba's Qwen, Mistral, and Google's Gemini - and requires each to answer inside a fixed JSON (JavaScript Object Notation) data format rather than free text. The implant tallies the four responses and acts on whichever action gets the most votes; if the vote is split, DeepSeek's answer serves as the tiebreaker.

The effect is that the AI providers' own servers function as the malware's command infrastructure. There is no attacker-run server issuing orders that defenders could trace and take down - just ordinary API calls to mainstream AI services, mixed in with legitimate traffic to the same endpoints.

## What it does once it decides

The vote resolves to one of four possible actions, though Talos found only three actually implemented in the sample it examined:

- **Steal** - dumps credentials from LSASS (the Windows process that holds cached logon secrets), lifts saved passwords from Chrome, Edge and Firefox, and pulls funds-related data from cryptocurrency wallets including MetaMask and Exodus.
- **Inject** - plants code in other running processes using asynchronous procedure calls or process hollowing, both standard evasion techniques.
- **Persist** - keeps itself alive across reboots through Windows Registry run keys, scheduled tasks, or WMI (Windows Management Instrumentation) event subscriptions.
- **Move** - a fourth action for lateral movement to other machines exists in the code but has no working handler in this build.

Anything it steals is encrypted with AES-256-GCM, a standard authenticated-encryption scheme, before being sent out through a Discord webhook rather than a dedicated server. To make analysis harder, the implant fires its decision cycle at randomized intervals of five to fifteen minutes and suppresses ETW (Event Tracing for Windows), the logging subsystem that many endpoint security tools rely on.

## Who built it, and whether it has been used

Talos says it found no evidence CLOSEDQUORUM has been deployed against a real target: the publicly available build ships with placeholder credentials that do not actually work, suggesting it may be a proof of concept or a work in progress rather than an active campaign. Artifacts inside the binary, however, tie its developer to posts on criminal forums about carding - trading in stolen payment card data - going back to 2025.

Talos places the sample on an autonomy escalation arc it has been tracking. Researchers first saw malware experimenting with optional LLM-generated code back in mid-2025, in samples known as LAMEHUG. In roughly a year, that has progressed from AI as an occasional scripting assist to AI as the thing actually making operational decisions, with no human in the loop at all once the malware is running.

## How CAIRN found it

CAIRN does not run or detonate suspicious binaries. It works entirely from metadata - the traces a program leaves behind, such as prompt templates, embedded API keys, references to AI provider endpoints, and jailbreak-style phrases used to coax restricted output from a model. The toolkit applies 24 filters tuned to this kind of evidence, things like hardcoded calls to api.openai.com or api.anthropic.com, imports of AI frameworks like LangChain or LiteLLM, or signs of local model runners such as Ollama or llama.cpp. Matches get stored and scored using a three-tier system of YARA rules, a pattern-matching format widely used in malware research: one tier for basic AI-related artifacts, one for behavioral context, and one for attributing a sample to a known malware family. Talos has published CAIRN on GitHub under the MIT license, along with six SHA256 file hashes and a YARA rule for CLOSEDQUORUM itself.

## What this means in practice

CLOSEDQUORUM has not been caught in an actual breach, so there is no incident to respond to today. What it does change is the shape of what defenders need to watch for: outbound connections to mainstream AI provider APIs from processes that have no business making them, credential-theft behavior that does not correlate to any known command server, and Discord webhook traffic carrying encrypted data. Security teams that already block or monitor AI API traffic from endpoints for data-loss reasons get a head start here, since the same visibility that stops an employee pasting secrets into a chatbot would also catch this pattern.

## Questions

**What is CLOSEDQUORUM malware?**
It is a Windows implant documented by Cisco Talos that queries a panel of four commercial AI models to decide its next action on an infected machine, rather than taking orders from a human-controlled server.

**Has CLOSEDQUORUM actually been used in an attack?**
Talos found no evidence of real-world deployment. The public build contains non-working placeholder credentials, which points to a proof-of-concept or early-stage tool rather than an active campaign.

**Which AI models does it use?**
It queries DeepSeek, Qwen, Mistral and Google Gemini, and resolves disagreements between them by majority vote, with DeepSeek breaking ties.

**What is CAIRN?**
CAIRN (Cognitive Artifact Intelligence Research Network) is an open-source toolkit Cisco Talos released to hunt for AI-integrated malware using only metadata, such as prompt templates and API keys, without running the malware itself.

**How can organizations detect this kind of malware?**
Talos published SHA256 file hashes and a YARA detection rule for CLOSEDQUORUM, and monitoring outbound traffic to mainstream AI provider APIs from unexpected processes is a practical way to catch this class of threat.

## Sources

- [The Closed Quorum: Inside the first reported autonomous AI C2 implant](https://blog.talosintelligence.com/the-closed-quorum-inside-the-first-reported-autonomous-ai-c2-implant/), Cisco Talos Blog
- [Researchers uncover malware that uses AI to choose its next move](https://www.helpnetsecurity.com/2026/09/22/cairn-open-source-framework-ai-malware-closedquorum/), Help Net Security
- [Cisco Talos Open-Sources CAIRN to Hunt AI-Integrated Malware](https://www.unite.ai/cisco-talos-open-sources-cairn-to-hunt-ai-integrated-malware/), Unite.AI