CLOSEDQUORUM Malware That Lets AI Vote on Its Next Move

The interesting part of CLOSEDQUORUM is not that it can steal passwords. Plenty of malware can. It is that the code asks a panel of AI models what to do next, counts their votes and dispatches the winning choice to a built-in capability.

That is the architecture Cisco Talos describes in research published by Ryan Fetterman on 22 September. The Windows implant supports up to four model integrations: DeepSeek, Qwen, Mistral and Google Gemini. Once configured and deployed, it is designed to make those tactical decisions without an operator sending each command.

The qualification matters as much as the finding. Talos has not confirmed deployment in the wild. The public distribution binary contains placeholder API keys and a dummy Discord webhook, and the researchers did not observe a complete end-to-end execution. They established the decision loop through static analysis, with development builds providing evidence of credentials being supplied at build time.

This is an analysed design for autonomous post-compromise decisions, not evidence of an autonomous campaign already working across victims’ networks.

A vote, not a free hand

The models do not receive an unrestricted terminal and permission to improvise an intrusion. The implant supplies host context and expects a structured response that its own code can interpret. The choice is constrained by what the developer implemented.

Talos describes a sequential process: query the available integrations, collect valid decisions, then select the action with the most votes. This is plurality voting, so a winning action does not necessarily have unanimous support or an absolute majority.

A tie is resolved by a fixed order: DeepSeek, then Qwen, then Mistral, then Gemini. That preference applies among responses supporting the tied leading actions. It is not evidence that DeepSeek always overrides a larger vote for something else.

The panel also has failure cases. Providers can refuse, time out or return unusable responses. If all models fail, the fallback value has no matching capability handler. The loop sleeps and retries rather than automatically choosing a theft action.

There is another useful limit in the code. The decision vocabulary includes move, but Talos found no handler for it in the distribution build. A word appearing in a prompt is not proof that lateral movement has been implemented.

Familiar damage, a different dispatcher

The implemented actions are conventional intrusion capabilities. According to Talos, selecting steal invokes three collection routines together: LSASS memory dumping, browser credential collection and cryptocurrency wallet extraction. The browser targets include Chrome, Edge and Firefox; the wallet targets include MetaMask, Exodus and Ethereum material.

Selecting inject sends execution into a process-injection path. Selecting persist invokes persistence functionality, with the report describing Registry, scheduled-task and WMI mechanisms. These are capabilities identified in the analysed code, not a guarantee that each will succeed against every Windows configuration.

The important change is who chooses between them. An operator supplies the initial access and a configured implant; the model-driven loop is intended to take over the next bounded set of decisions. It does not remove the need to get the executable onto a machine, establish the required access or supply working service credentials.

Talos calls this effort displacement: moving work away from the person running the intrusion. A more practical way to put it is that the operator need not be watching for the program to request its next instruction. Whether that produces useful decisions consistently is a separate question, and an inert public build cannot answer it.

Discord is still in the picture

Replacing a dedicated tasking server does not mean the malware has no reporting channel. The design uses an operator-configured Discord webhook for selected decisions, associated reasoning and collected material.

Talos assesses that the developer prepares a separate executable for each operator, supplying the webhook and model API credentials during compilation. That service model is an inference from development artefacts, not a confirmed account of sales or deployment.

The report also describes AES-256-GCM encryption for collected data, using a key derived from the current date. The algorithm name should not distract from the key design. Talos notes that this does not establish confidentiality between the developer and an operator: someone with the required implementation knowledge and date could derive the key too.

The public sample’s dummy settings are therefore not a minor footnote. They are the reason the published analysis can explain the intended architecture without demonstrating the whole system operating successfully.

Follow the process across services

For defenders, the useful question is not simply whether a machine contacted an AI provider. Legitimate software does that. Discord traffic, considered alone, is similarly inconclusive.

Talos recommends looking for the combination: an unexpected Windows executable contacting model services, alongside credential access, process injection or persistence activity, with Discord communication from the same process or host. Multiple provider requests in a short interval are relevant context, not a sufficient verdict on their own.

That distinction changes how to use the report. Treat the named services as investigation context, not a ready-made blocklist. Correlate process identity and timing with endpoint activity. Check whether the application has a legitimate reason to contact those services and whether its local behaviour matches its stated purpose. Host-level correlation is weaker than process-level attribution, especially on a busy machine.

Do not assume the prompt text will appear in ordinary network logs. Talos explicitly notes that seeing host context or offensive instructions inside requests would generally require TLS inspection or provider-side telemetry. An encrypted connection record is not a transcript of what the model was asked.

The reported timing also matters to analysis: a five-minute initial delay and subsequent randomised intervals of 5 to 15 minutes can leave a short sandbox run with little to report. These are characteristics of the analysed implementation, not fixed timings on which to build the entire detection.

Read the detection material carefully

Talos discovered CLOSEDQUORUM through CAIRN, its newly released Cognitive Artifact Intelligence Research Network. The repository describes a research workflow based on VirusTotal metadata, without downloading or detonating binaries. It assembles scan text from report fields and applies classification rules to that representation.

That matters when reusing the detection material. A rule matching sandbox labels or other report metadata is not automatically equivalent to a file-scanning signature. Talos’s published CLOSEDQUORUM rule distinguishes metadata anchors from binary-level strings. Read those assumptions before adopting it, validate it against the intended input, and test for benign matches.

ZDW has not executed the malware or tested those detections. The practical takeaway here is the correlation strategy, not a claim that an untested query or copied rule provides coverage.

Autonomy still has dependencies

Talos qualifies its novelty claim as the first publicly documented Windows implant of this kind to its knowledge. That wording deserves to survive the headline cycle, along with the absence of confirmed real-world deployment and the incomplete execution evidence.

The design is still worth examining. It shows how an attacker can place a small decision layer between existing malware capabilities and commercially available models. The models choose from the menu; the implant remains responsible for carrying out the action.

That introduces dependencies as well as possibilities. Credentials must work. Providers must respond. Responses must be usable. The local actions still encounter endpoint controls. For a defender, the opportunity is to connect those dependencies to the behaviour on the machine, rather than mistake ordinary-looking service traffic for an ordinary-looking process.