This Malware Asks Four AI Models What to Do Next, Then Does Whatever Wins the Vote

For as long as there has been malware, there has been somebody on the other end of it. The implant lands, calls home, and waits. A person reads what it found and decides what comes next: dump credentials, move sideways, dig in, or leave quietly. That person sits in the middle of the attack, and a lot of detection is built around them. Command-and-control servers can be found and taken down. Operators keep working hours. There are pauses while a human thinks.

On 22 September, Cisco Talos published an analysis of a Windows implant that replaces that person with a committee of commercial AI models.

What Talos found

The malware is ClosedQuorum (styled CLOSEDQUORUM in the report). Talos researcher Ryan Fetterman describes it in The Closed Quorum: Inside the first reported autonomous AI C2 implant as, to Talos's knowledge, the first publicly documented Windows implant to hand tactical command-and-control decisions to a panel of large language models. BleepingComputer and Help Net Security covered it the same day.

The mechanics are simple, which is part of the point:

• It takes stock of the host. ClosedQuorum is a 16.4 MB Go binary. It collects the hostname, OS architecture, CPU count, Windows version, whether it is running as admin, and the process it is currently targeting.
• It asks four models. That context goes into a prompt sent in turn to DeepSeek, Qwen, Mistral and Google Gemini. The system prompt tells each model it is "an advanced malware strategist" and must return only executable decisions. The model has to pick from a fixed menu (steal, inject, persist or move) and answer in typed JSON. Anything malformed is thrown away.
• It counts the votes. The option with the most votes runs. On a tie, DeepSeek decides, followed by Qwen, Mistral and Gemini. If nothing usable comes back, the fallback is a "consensus" value with no handler, so the implant simply tries again.
• It repeats. The loop runs at random intervals of 5 to 15 minutes.

The actions behind the menu are ordinary crimeware. steal dumps LSASS, pulls saved credentials from Chrome, Edge and Firefox, and takes MetaMask, Exodus and Ethereum wallets. inject produces shellcode for process hollowing or Early Bird APC injection. persist runs a persistence module. Stolen data leaves through a Discord webhook, encrypted with AES-256-GCM. The move handler for lateral movement is listed on the menu but is missing from the build Talos examined.

What it isn't, yet

Talos is careful about the limits, and so should we be.

There is no confirmed deployment in the wild. The sample Talos analysed statically contains placeholder API keys (dummy_api_key) and dummy webhook addresses. Development builds show provider keys compiled in at build time, which suggests operators are sold customised executables with their own credentials embedded. Artifacts in the binary tie the developer to carding-related posts on criminal forums going back to 2025.

It is also not the first malware to talk to an LLM. Ukraine's CERT-UA documented LAMEHUG in July 2025, which fetched commands from a Qwen coding model through the Hugging Face API. Fetterman expected that to set off a wave. It did not. According to RuntimeWire's account of the research, roughly nine named AI-integrated malware families had been publicly documented by July 2026. "It just wasn't what I was expecting," he said of that count.

Talos's own summary is the right way to read it: ClosedQuorum is "best understood not as a sophisticated piece of malware, but as a demonstration that the architectural shift towards attack-chain automation is coming." Humans still designed, built, configured and delivered it. What they removed is the operator in the phase after it lands.

Why removing the operator matters

Talos makes a point that is easy to skim past: "Effort displacement compounds the effects of speed and scale because the human-in-the-loop is no longer the bottleneck."

A human operator can only work so many intrusions at once. Every infected host waiting for a decision is a host where nothing is happening, which gives defenders time. An implant that makes its own decisions every ten minutes doesn't wait, and a crew can sell it to buyers who couldn't run the post-compromise phase themselves.

It also removes infrastructure defenders are used to hunting. ClosedQuorum has no dedicated C2 server to sinkhole. Its "brain" sits behind the same API endpoints your developers and products call every day, including api.deepseek.com, openrouter.ai and api.mistral.ai, and its output goes to Discord.

This is the other side of a pattern we have been following. Earlier this month, DUSTMAKER planted weapons jailbreaks in its code so that AI scanners would refuse to read it: malware attacking the defender's AI. Last week, Anthropic's threat report showed attackers running intrusions on stolen AI API keys, so the activity was billed to the victim. ClosedQuorum completes the set. The attacker's AI now makes the decisions on the infected host. Its keys come from the operator today, but nothing in the design stops them coming from a key it finds on the machine.

How to detect it: patterns, not domains

The obvious response is to block the AI providers. Talos advises against relying on that, and it is right. Most organisations legitimately call at least one of these endpoints, and OpenRouter alone fronts hundreds of models. A domain blocklist would break your own products and still miss the next implant that picks a different provider.

What Talos recommends is correlation. Contact with an AI provider, on its own, is noise. Combined with other signals, it narrows down fast:

1. AI-provider traffic from a process that has no business making it. A signed IDE, a browser or your own backend service calling an LLM API is expected. An unknown executable in a user's AppData folder is not.
2. Several providers queried within seconds. Few legitimate desktop applications ask four different vendors the same question in a row.
3. That traffic alongside the rest of the kill chain: LSASS access, a Registry Run key or WMI persistence, process injection, ETW suppression, and outbound connections to Discord webhooks.
4. A steady rhythm. Bursts of multi-provider calls every 5 to 15 minutes from the same host.

Talos has also open-sourced CAIRN (Cognitive Artifact Intelligence Research Network), the toolkit that found ClosedQuorum. It works only from file metadata and searches for what Talos calls cognitive artifacts: embedded prompts, provider endpoints, API-key prefixes, jailbreak strings and orchestration logic, without downloading or running the binary. Through it, Talos found about 20 further examples beyond the publicly named families. Threat-intel teams should look at it. The IOCs in the Talos post include six SHA-256 hashes for development builds.

There is a catch in the correlation advice. It only works if the evidence ends up in one place. Endpoint telemetry tells you a process touched LSASS. Proxy or DNS logs tell you something called api.deepseek.com. Neither answers the question on its own, and in most organisations they sit in different consoles owned by different teams.

Where Obiguard fits

This is a job for Obiguard SOC, and the boundary comes first. SOC is not an EDR. It does not watch process memory or stop an LSASS dump as it happens, so keep your endpoint agent. What SOC does is give the endpoint signal and the network signal a shared place to be read together.

Put the AI traffic next to the host events. Logs, host metrics and traces arrive in SOC through the OpenTelemetry Collector, so proxy, DNS and firewall logs can sit alongside Windows event and endpoint-agent logs. In Live Logs, filtering by full text on openrouter.ai or api.deepseek.com and then narrowing to one host shows which processes made those calls and what else that host did in the same few minutes. That is the view Talos's correlation advice assumes you already have.

The rhythm shows up as a signal. A process that calls four providers every 5 to 15 minutes produces a regular pattern in egress logs where there used to be none. SOC raises alerts from log-volume changes and rule matches as they come in. Each alert keeps an evidence timeline linked back to the raw events that triggered it, so the analyst who picks it up starts from the actual requests, not a summary.

The Discord leg doesn't hide either. Exfiltration to a webhook is one more egress event in the same stream. On a host that is also making multi-provider AI calls, that alert lands next to them in the same timeline rather than in a separate queue a day later.

There is a quieter step that makes all of this easier. If your organisation's sanctioned AI use already goes through a known path, such as a gateway like Governance AI, then "which processes are allowed to call an LLM provider directly?" has a short answer. Everything outside that list is worth a look. ClosedQuorum depends on AI-provider traffic being so common that nobody questions it. Sending your own AI traffic through one known route takes that cover away.

The question to take away

ClosedQuorum is a proof of concept with dummy keys, a missing lateral-movement handler, and a tie-break rule that hands every close call to DeepSeek. It is not the most dangerous thing on your network this week. But it shows where attack-chain automation is heading: the decision-maker is now an API call, made over the same encrypted connections to the same providers your own teams use.

So the question for your detection programme is not are we blocking AI providers? It is: if an unknown process on one of your laptops started calling four AI providers every ten minutes, which of your consoles would show it, and would it show the LSASS access in the same view?

Explore Obiguard SOC or talk to us about bringing endpoint, network and application logs into one timeline, so the pattern Talos describes can be seen in one place.