CLOSEDQUORUM: Cisco Talos Finds Windows Malware That Lets Four AI Models Vote on Its Next Move

Malware has used automation for decades, but almost always with a human or a fixed script deciding what to do next. On September 22, 2026, Cisco Talos described a Windows sample that does something different: it asks four commercial AI models what to do and obeys the majority.

Talos calls it CLOSEDQUORUM. It has not been seen succeeding end to end, and no active victims are documented. Still, it is the first Windows malware publicly reported to hand its tactical decisions to a panel of LLMs, and it arrives alongside a run of stories about agents acting beyond their instructions, such as the Medicare portal incident. This guide explains how it works, what is proven, and how defenders can look for it.

TL;DR

How the voting works

CLOSEDQUORUM's loop, per Talos:

1. Collect basic facts about the machine: name, Windows version, whether the user is an administrator.
2. Send them to a model with a fixed list of four allowed actions and a system prompt that positions the model as an "advanced malware strategist."
3. Repeat for each model, in sequence: Gemini, DeepSeek, Qwen, Mistral.
4. Tally the answers and run the action with the most votes. DeepSeek breaks ties.
5. Wait 5 to 15 minutes and repeat.

Researcher Ryan Fetterman summarized it: "Four models are queried in sequence, their independent verdicts tallied, and the binary acts, based on their judgment."

The four actions

Stolen data is encrypted and sent out through Discord webhooks, a common channel because it blends into normal traffic.

Why it is not a doomsday tool (yet)

Several details argue for calm.

• It does not work as published. Talos has not seen the setup work from start to finish.
• The decision is shallow. The models choose among four fixed actions based on three host facts. They are not writing exploits. The malware's real capability is still the pre-written modules.
• It depends on public APIs. Every decision requires a call to a commercial AI service, which leaves a network signal and a dependency that providers can block.
• It appears to be in development. Talos recovered six samples spanning roughly one week and tied the developer to criminal forum activity since 2025, suggesting the author intends a credentials-as-a-service business.

So why write about it? Because the design choice, not the code, is the news.

Why attackers might want a model vote

Several motives are plausible; Talos does not claim to know the author's reasoning.

• Reduced command-and-control. Traditional malware talks to an attacker's server, which defenders can find and take down. Here the "brain" lives in third-party AI services that resolve to popular domains.
• Variation. A vote among models can yield different actions on different hosts, making behavior less predictable for signature-based tools.
• Lower skill barrier. An operator can lean on models for tactical choices they would otherwise have to encode.
• Redundancy. Four providers means one blocked API does not stop the loop.

These are advantages in theory. In practice, sending host data to commercial AI services also creates a record on the provider side and a risk of being flagged or blocked. The vote design also adds latency and cost.

CAIRN: how defenders can hunt for this class of malware

Talos found CLOSEDQUORUM using CAIRN, the Cognitive Artifact Intelligence Research Network, and released it as open source on GitHub. According to reporting:

• It analyzes malware metadata without executing the sample.
• 24 acquisition filters identify artifacts of AI integration, such as embedded API endpoints, prompt-like strings and key patterns.
• YARA rules classify findings by sophistication tier.
• Embedding models cluster samples that lack common strings, which helps find variants.

For SOC teams, the interesting part is the search space: AI-integrated malware leaves artifacts that traditional families do not.

Practical defenses

Network

• Restrict outbound traffic to AI API endpoints from servers and workstations that have no business calling them. A finance workstation should not be talking to a model API.
• Alert on unusual volume or timing of requests to Gemini, DeepSeek, Qwen or Mistral endpoints from unexpected processes.
• Watch for Discord webhook traffic from non-browser processes.

Endpoint

• Apply detections for the listed persistence methods: registry run keys, scheduled tasks and WMI event subscriptions.
• Protect credential stores: LSASS access controls, browser credential protection and application allow-listing.
• Monitor for code injection patterns.

Hunting

• Search binaries for embedded API keys, base URLs of AI providers and prompt text such as "malware strategist."
• Try CAIRN on suspicious samples during triage.

Governance

• Inventory legitimate AI API usage in your environment so anomalies stand out.
• Rotate and scope API keys. Stolen keys can become a channel for attackers.

A defender's detection checklist, in order

If you have limited time, work through these in order of cost and value.

1. Egress inventory. List which internal hosts legitimately call AI APIs (developer laptops, notebooks, production services). Everything else calling those domains is suspicious by default.
2. DNS and proxy logs. Search for lookups of AI provider API hostnames from servers, kiosks and finance or HR workstations. Correlate with process names where your EDR can.
3. Discord webhook traffic. Look for POSTs to Discord webhook URLs from non-browser processes. Legitimate use on servers is rare.
4. Persistence audit. Review new registry run keys, scheduled tasks and WMI event subscriptions created in the last 30 days, especially those launching unsigned binaries.
5. Credential exposure review. Check LSASS access events and browser credential store access by unexpected processes.
6. Static triage. Run suspicious binaries through string and YARA checks for embedded API base URLs, model names and prompt text. CAIRN automates part of this.
7. Key hygiene. Rotate any AI provider keys stored on endpoints, and use scoped keys with spending limits so a stolen key is not a blank check.

What providers and vendors can do

The malware's design puts model providers in an awkward position: their public APIs become the malware's decision engine. Reasonable responses, which providers may or may not adopt:

• Abuse detection on prompts. A system prompt casting the model as a malware strategist with a fixed action menu is a recognizable pattern.
• Key-level anomaly detection. Many keys making the same fixed-schema request every 5 to 15 minutes from residential or compromised IP ranges is a distinctive signal.
• Faster revocation and takedown for keys embedded in malware once samples are shared.
• Threat sharing. Talos's work shows how much value comes from researchers and providers exchanging indicators.

None of this eliminates the risk, since attackers can use open-weight models they host themselves. But it raises the cost, and it is exactly the kind of misuse reporting that model providers already publish in their threat reports.

The AI-abuse picture this fits into

CLOSEDQUORUM sits in a growing catalog of AI-enabled crime:

• Phishing at scale. Microsoft and Coinbase recently dismantled EvilTokens, an AI cybercrime platform.
• Agents as targets. Plugin4Shell was a zero-click remote code execution issue hitting multiple coding agents.
• Fake apps. Fake Claude apps delivered crypto-stealing malware.
• Provider reporting. Anthropic's threat intelligence report documents misuse patterns from a model provider's view.
• Injection risk. Agents that read untrusted content can be steered; see indirect prompt injection.

The shared thread is that AI is both the tool and the target, and defenders need visibility into AI traffic.

What people are asking

"Does this mean malware is now autonomous?" Not in a meaningful sense. It chooses among four fixed actions based on limited inputs, and the public version does not work.

"Can AI providers stop it?" They can block abusive keys and detect prompts, and some will. Attackers can switch providers, which is part of why the design uses four.

"Should I block AI APIs?" Not broadly. Restrict them to hosts and processes that need them and monitor the rest.

"Is this connected to agent safety?" Indirectly. Both involve models making tactical decisions with real-world consequences. The difference is intent.

Bottom line

CLOSEDQUORUM is a prototype, but it is a telling one: attackers are experimenting with using commercial models as live decision engines. The defensive response is familiar, network egress control, credential protection and behavioral detection, plus a new item on the checklist: know which processes on your network talk to AI services, and why.

This report summarizes Cisco Talos's September 22, 2026 findings as reported by SiliconANGLE, The Hacker News and others. Details may change as Talos and vendors publish more analysis.

Related reading

• OpenAI agent breached an Australian Medicare portal
• Microsoft and Coinbase dismantle EvilTokens
• Plugin4Shell: zero-click RCE in AI coding agents
• Anthropic threat intelligence report, September 2026
• Fake Claude app RevStealer crypto malware
• What is indirect prompt injection?
• DeepSeek DSec and agent sandboxes
• Official: SiliconANGLE on Talos findings, The Hacker News