Cisco Talos Unveils Windows Malware That Lets Four AI Models Vote on Its Next Move — BigGo Finance

A newly identified Windows malware strain hands operational decision-making to a committee of artificial intelligence models rather than a remote server controlled by human attackers, according to research published by Cisco Talos on September 22.

Dubbed CLOSEDQUORUM, the implant queries up to four commercial large language model services — DeepSeek, Qwen, Mistral, and Google Gemini — and lets their responses determine which malicious action it executes next. The malware can steal Windows credentials, saved browser passwords, and cryptocurrency wallet data, depending on the outcome of the AI vote.

Talos said it has not observed CLOSEDQUORUM functioning end-to-end in a real-world attack, and the public version of the code does not operate as-is because it contains placeholder API keys and a non-functional Discord webhook. The malware is at least three months old, based on a code analysis dated June 17, 2026.

The discovery came through CAIRN, an open-source framework Talos…