CLOSEDQUORUM: Cisco Talos documents a Windows implant that lets four AI models vote on its next move

Cisco Talos published an analysis on Tuesday, September 22, 2026, of a Windows implant it calls CLOSEDQUORUM. Talos describes it as the first publicly documented Windows implant that hands its command-and-control decisions to AI models instead of a human operator. Once the malware lands on a machine, it doesn't wait for instructions. It describes the host to as many as four commercial large language models (DeepSeek, Qwen, Mistral and Google Gemini), lets them vote on what to do next, and then carries out whichever action gets the most votes. Per the Talos write-up by researcher Ryan Fetterman, the stolen results go back to the operator through a Discord webhook, and the cycle repeats every 5 to 15 minutes at randomized intervals.

There are two big caveats, and Talos states both itself. It has no confirmation that CLOSEDQUORUM has been used in the wild. The build it analyzed also shipped with placeholder API keys and dummy webhooks, so, in Talos's words, "we did not observe a complete end-to-end execution of the architecture." This is a documented design, recovered from real binaries, with an apparent criminal author behind it. It is not a confirmed campaign.

How the quorum works

Talos lays out the loop step by step. On deployment, the implant collects basic system information: hostname, OS architecture, CPU count, Windows version, and whether it is running with admin rights. It puts that into a structured prompt and sends it to each configured provider in turn. The system prompt Talos recovered opens: "You are an advanced malware strategist. Provide ONLY executable decisions." Each model has to answer in constrained JSON and choose one of four decisions: inject, persist, steal or move.

The votes are tallied by plurality. Ties go to a fixed preference order, per Talos: DeepSeek first, then Qwen, then Mistral, then Gemini. If every provider fails, the implant sleeps and retries rather than falling back to a default action. The operator never picks a move. They only get the output.

Each decision maps to a hardcoded capability handler, so the models are choosing from a menu, not writing new attacks on the fly. "Steal" runs LSASS memory dumping, browser credential theft and cryptocurrency wallet extraction all at once. Talos lists the targets as Chrome and Edge saved logins, Firefox's logins.json, the MetaMask browser extension, Exodus and Ethereum wallets. "Inject" branches to either process hollowing or Early Bird APC injection. "Persist" sets up persistence through registry Run keys (a value named WindowsUpdate), scheduled tasks, a WMI event subscription that fires every 60 seconds, and a PowerShell script written to C:\Windows\Temp\wmi.ps1. "Move," the lateral-movement option, is in the response schema but, per Talos, has no handler in the distribution build.

Why four models instead of one

A lot of the early coverage framed the four-model design as a deliberate way around AI safety guardrails. Talos's own explanation is more practical. "The multi-provider design serves both aggregation and resilience, reducing the effect of individual refusals, timeouts, and malformed responses," the post says. "Four models increase the chance that the quorum reaches a decision even if one or two members are unresponsive, or for example, one model is hitting a guardrail."

The distinction matters. The design doesn't need to jailbreak any single model. It assumes some requests will be refused or fail, and it routes around them with redundancy, the same way a well-built production service treats a flaky upstream API. The effect is still that one provider's refusal doesn't stop the implant, but it gets there through voting math, not a clever prompt.

What's actually new here

Malware calling an LLM mid-execution isn't new in itself. In November 2025, Google's Threat Intelligence Group reported families that used language models at runtime. One was PROMPTFLUX, a VBScript dropper that called the Gemini API to rewrite its own code. Another was PROMPTSTEAL, which Google attributed to Russia's APT28. It queried a Qwen coding model through Hugging Face to generate Windows commands, and Google said it was the first malware it had seen querying an LLM in the wild.

The difference Talos points to is scope. Earlier examples used a model for one job: generating a command, or mutating code to avoid detection. CLOSEDQUORUM gives the models the post-compromise decision loop itself, meaning what to do next on this machine, over and over, with nobody watching. Talos calls this "effort displacement": a whole phase of the attack chain moves from a human to an automated system. Its broader point is that the limit on how many compromised machines one criminal can manage shifts from how much attention they have to how much API access they can get.

The author isn't a nation-state, at least as far as Talos can tell. Per the analysis, artifacts in the binary tied the developer to postings on criminal forums related to carding, going back to 2025. That's a financially motivated operator. The steal-first menu of saved passwords and crypto wallets fits that profile better than an espionage one.

The weak points

Talos is candid about how fragile the design is. Its dependence on commercial AI APIs cuts both ways. Providers can refuse, rate-limit, revoke keys or just return malformed output, and every one of those is a failure mode for the implant. The tie-breaking order is fixed and predictable. The four-option action schema keeps the models from wandering, but it also means the "autonomy" is limited to choosing among capabilities a human already wrote. The implant is an automated decision layer on top of a fairly conventional credential stealer, not a self-directing hacker.

That's also why the defensive advice is fairly concrete. Talos says "the most useful detection strategy is still to focus on behavioral characteristics, rather than domain blocking." Blocking AI provider domains outright isn't realistic in most companies, since legitimate software talks to them all day. Instead, Talos highlights "AI-provider API traffic originating from an unexpected Windows executable," several different providers contacted within a short window, and those signals combined with LSASS access, process injection, WMI persistence and Discord webhook traffic. Any one of these alone is noisy. All of them together from the same unsigned binary are not.

CAIRN: the hunting kit that found it

Talos says it found CLOSEDQUORUM through its CAIRN project, short for Cognitive Artifact Intelligence Research Network, and released CAIRN as an open-source toolkit on GitHub the same day as the write-up. Per Talos and BleepingComputer's coverage, it looks for the traces AI integration leaves inside malware: prompt templates, AI provider endpoints, embedded API keys, jailbreak phrases and similar artifacts. That's a useful angle for defenders. Malware that depends on an LLM has to carry its prompts and endpoints with it, and those strings are much harder to disguise than ordinary code.

Talos's disclosure doesn't include specific recommendations for the AI providers whose APIs the implant is built to call. It also doesn't explain in detail how CAIRN first surfaced the sample. Both are open questions worth watching as other vendors look for related builds.

Why it matters

Nobody should read CLOSEDQUORUM as proof that autonomous AI malware is loose on corporate networks. Talos explicitly says it hasn't confirmed that. The more grounded takeaway is that a criminal developer, not a research lab, has already built the whole scaffolding for an operator-free implant. It was pieced together from off-the-shelf model APIs, a voting loop and a Discord webhook, and six builds were produced in a week. The components are cheap and the pattern is now public. Defenders' best advantage is the one Talos points to: this kind of malware has to phone home to AI providers from places it shouldn't, and that traffic can be spotted.