Malware Lets 4 AI Models Vote on Its Next Attack Move

Cisco Talos on Sept. 22, 2026 published an analysis of a Windows implant it calls CLOSEDQUORUM, describing it as "the first reported autonomous AI command and control implant." The 16.4MB, 64-bit executable, compiled in Go, does not wait for instructions from a person. After it lands on a machine, it asks up to four commercial AI services what to do next — and does whatever most of them say.

The four providers, according to the Talos write-up by researcher Ryan Fetterman, are DeepSeek, Qwen, Mistral and Google Gemini. Each is queried in turn with the same structured prompt, which includes the host's name, OS version, CPU count and admin status. The models are not free to answer however they like: the binary forces them into a typed JSON schema with four possible decisions — steal, inject, persist or move. The system prompt recovered from the binary reads, "You are an advanced malware strategist. Provide ONLY executable decisions." Whichever decision collects the most votes is executed automatically.

Talos's decompilation shows the tie-breaking is deterministic and tilted toward DeepSeek, then Qwen, Mistral and Gemini in that order. If every model refuses, times out or returns malformed output, the implant falls back to a string with no matching handler, so the loop sleeps and retries rather than picking a default attack. The cycle repeats at randomized five-to-15-minute intervals.

A steal verdict fires three modules at once: an LSASS memory dump for Windows credentials, saved passwords from Chrome, Edge and Firefox, and wallet files from MetaMask, Exodus and Ethereum. Talos says the haul is encrypted with AES-256-GCM using a key derived from the current date, Base64-encoded, and posted to an operator's Discord webhook in 1,900-byte segments.

Two findings sit side by side in the same post and should not be merged. Talos states plainly that it has no confirmation of in-the-wild deployment: the publicly recovered distribution build initializes every API key to dummy_api_key and the webhook to dummy_webhook_url, making that copy inert. Separately, Talos writes that evidence from development builds shows provider credentials injected at compile time, which it reads as a per-operator, custom-built distribution model. Tech Times, reporting on the research on Sept. 23, 2026, summarized that second point as the binary being commercially distributed on a per-operator basis. Talos adds that artifacts from the binary tie the developer to criminal-forum postings about carding dating back to 2025.

The reason Talos treats this as a milestone is what it calls effort displacement: AI has mostly made attackers faster, but here a whole phase of decision-making moves off the human. Talos published the analysis alongside CAIRN, an open-source toolkit for tracking AI-integrated malware, and argues the architecture also creates weaknesses — model refusals, rate limits and that predictable tie-break. What remains unknown is whether any operator ever ran a live build, and how many.