Breaking

Cisco Talos Says CLOSEDQUORUM Malware Lets Four AI Models Vote on Attack Steps

September 23, 2026 at 10:19 EDT

Security
AI Agents

Cisco Talos has documented CLOSEDQUORUM, a Windows implant that delegates tactical command-and-control decisions to a panel of up to four commercial LLMs: DeepSeek, Qwen, Mistral and Google Gemini. The malware does not require continuing instructions from a human operator after deployment; it gathers host context, asks the models to choose from a fixed menu of actions, and executes the winning decision.

Sept. 22, 2026 · Cisco Talos

Malware Lets AI Models Vote

CLOSEDQUORUM is a Windows implant that asks up to four LLM providers to pick its next post-compromise action, then runs the winning choice without a continuing human command channel.

LLM providers in the quorum

16.4MB

64-bit Windows executable

allowed action choices

1,900

byte exfiltration segments

Randomized retry window

The implant repeats activity at 5-to-15-minute intervals; the stacked columns show the documented minimum and maximum on the same minute scale.

5 minminimum

15 minmaximum

Decision loop

Host context

Hostname, architecture, CPU count, Windows version and admin status.

→

Model vote

DeepSeek, Qwen, Mistral and Gemini choose within a fixed schema.

→

Action runs

The winning choice maps to steal, inject, persist or move.

Why defenders care

The C2 signal becomes a behavior pattern: model-provider traffic plus credential access, injection, persistence and Discord communication.

Why it is limited

No confirmed in-the-wild deployment was reported, and the public build contained dummy credentials and a dummy webhook.

Continue reading

The rest of this article is for AI News Blitz readers. Choose an option below to keep reading.