Cisco Talos Finds Malware That Lets AI Models Vote

Cisco's Talos threat-intelligence group said Tuesday it found a Windows malware sample, CLOSEDQUORUM, that queries four commercial AI models and carries out whichever action wins a vote among them, rather than waiting for instructions from an attacker's own server.

The research, published by Talos security researcher Ryan Fetterman, calls CLOSEDQUORUM "the first reported autonomous AI command and control implant." Talos released the finding alongside CAIRN, an open-source toolkit for detecting AI-integration artifacts in other malware samples, and a companion writeup covered separately by SiliconANGLE.

How the vote works

CLOSEDQUORUM is a 16.4-megabyte, 64-bit Windows binary written in Go. Every five to 15 minutes, it queries DeepSeek, Qwen, Mistral and Google Gemini in sequence, feeding each model the infected machine's computer name, Windows version and administrator status. Each model answers with one of four hard-coded actions: steal, inject, persist or move. The action with the most votes runs; ties go to DeepSeek first, then Qwen, Mistral and Gemini in that order.

A system prompt embedded in the binary instructs each model: "You are an advanced malware strategist. Provide ONLY executable decisions." Fetterman said the design means "the attacker does not have to send commands once the malware is running," since the models make the call themselves.

What the four actions do

Action	What it does
Steal	Dumps LSASS memory, harvests saved Chrome, Edge and Firefox passwords, and pulls MetaMask, Exodus and Ethereum wallet files
Inject	Builds shellcode and injects it via process hollowing or Early Bird APC injection
Persist	Adds a Registry Run key, a scheduled task and a WMI event subscription
Move	No handler exists in the distributed build

A Discord webhook relays each vote and any stolen data back to a channel the attacker controls, in place of a traditional command server.

No sign it has run outside a lab

Talos was explicit about what it does not have: "we do not have confirmation of in-the-wild deployment." The public sample ships with placeholder API keys and a dummy Discord webhook, which leaves it non-functional exactly as distributed. Talos published six SHA-256 hashes tied to development builds and said artifacts in the code connect its developer to criminal-forum posts about carding dating to 2025.

AI systems have landed on both sides of a security incident more than once in 2026: a malicious browser extension can hijack the AI agents built into five browsers without tripping their own safeguards, and researchers separately tied a flood of RubyGems packages to OpenAI's own coding agents.

Why Talos built a separate tool for this

CAIRN, short for Cognitive Artifact Intelligence Research Network, works from a sample's metadata rather than requiring a download or a detonation. It applies 24 acquisition filters to spot AI-integration artifacts, sorts what it finds into three tiers with YARA rules, and uses an embedding model to group samples that share no common strings. Talos has run it against malware collected since July 2025.

Fetterman said AI integration in malware has moved from optional add-ons in 2025 to core operational control in 2026, and that defenders have "a window to study the transition before it becomes ordinary." Talos did not say how many CAIRN-flagged samples it is tracking as of this report.