Cisco Talos finds AI-voting command loop in Windows malware

Cisco Talos says it found a Windows malware sample designed to ask up to four large language models to choose its next action without continued human commands. The researchers call the implant CLOSEDQUORUM, but their static analysis found no confirmation that it has been deployed in the wild.

The public distribution build was non-functional as distributed. It contained placeholder API keys and a dummy Discord webhook, and Talos said it did not observe a complete end-to-end execution of the architecture. The result is a technically documented design, not evidence of a completed attack campaign.

Talos describes CLOSEDQUORUM as a 16.4 MB, 64-bit Windows executable compiled in Go. Its orchestration loop queries DeepSeek, Qwen, Mistral and Google Gemini in sequence, parses their responses into a defined JSON structure, counts the proposed actions and executes the option with the most votes.

That autonomy remains bounded by code already present in the implant. The models can select among actions whose handlers cover credential and cryptocurrency-wallet theft, process injection and persistence. A “move” option appears in the decision schema but has no handler in the public build, and malformed or unsupported responses are discarded.

This panel design adds redundancy, but it does not guarantee a decision. Talos found that refusals, timeouts, rate limits and malformed output can remove models from a round. If every provider fails, the implant sleeps and retries instead of taking a default action.

CLOSEDQUORUM surfaced through Cisco Talos’s open-source CAIRN toolkit, which searches VirusTotal metadata for signs of AI integration. According to the repository, CAIRN uses metadata and sandbox-behavior records rather than downloading or detonating binaries.

Talos said artifacts in the binary connected its developer to carding-related criminal-forum posts dating to 2025. The researchers did not confirm the developer’s identity, the relationship between the analyzed files and any operator, or whether any listed model provider handled requests from a deployed build.