A newly documented Windows implant called ClosedQuorum makes its own ClosedQuorum AI malware decisions by putting them to a vote across four large language models, with no human operator required once the malware is on a machine. The Hacker News reported the discovery on 22 September 2026, and the analysis was carried out by Cisco Talos researchers.
The Go-based malware consults Google Gemini, DeepSeek, Qwen, and Mistral during the post-compromise phase of an attack, feeding each model reconnaissance data and letting the group collectively determine the next move. When votes are tied, DeepSeek gets the casting vote, followed in priority order by Qwen, Mistral, and Gemini.
What ClosedQuorum Can Actually Do
The models are not given free rein. They choose from a predefined menu of four actions. The ‘steal’ decision fires simultaneously: LSASS credential dumping, browser credential theft across Chrome, Edge, and Firefox, and cryptocurrency-wallet extraction targeting MetaMask, Exodus, and Ethereum wallets. The ‘inject’ decision generates shellcode and then deploys it via either process hollowing or Early Bird APC injection. ‘Persist’ runs the malware’s own persistence module. A fourth option, ‘move’, covers lateral movement, but in the build Cisco Talos examined, the corresponding handler is absent, meaning it cannot actually execute.
Whatever is stolen gets piped back to the operators through a Discord webhook. That single design choice means the entire attack chain, beyond the initial delivery, can run without any human involvement at any point.
Cisco Talos describes ClosedQuorum as the first publicly documented Windows implant to delegate tactical command-and-control decisions to a panel of AI models. The researchers say the architecture adds speed and scaling potential to malicious operations and removes the constraint of needing a human available to issue commands.
Limitations and the Question of Real-World Use
The same reliance on commercial APIs that makes ClosedQuorum autonomous is also a vulnerability in the design. Cisco notes that rate limits, malformed model output, and temporary API unavailability could all break the attack chain at critical moments. The implant is not described as technically sophisticated, and Cisco Talos says it is unclear whether ClosedQuorum represents a finished weapon or an experiment.
What the researchers are clear about is the direction of travel. They characterise ClosedQuorum as representing ‘an architectural shift towards attack-chain automation.’ Cisco Talos adds that it has no confirmation of in-the-wild deployment, but found that ‘artifacts from the binary were used to connect the developer to postings on criminal forums related to carding, dating back to 2025.’
The build analysed by Cisco Talos contains placeholder API credentials and a dummy Discord webhook. Operators building their own versions of ClosedQuorum would substitute real credentials at that stage, leaving the core architecture intact.
CAIRN: The Toolkit Behind the Discovery
Cisco Talos found ClosedQuorum using CAIRN, an open-source toolkit it released specifically to help researchers track and analyse AI-integrated malware. The tool appears to be surfacing a broader trend. According to eSecurityPlanet, researcher Ryan Fetterman identified roughly 20 additional examples of AI-integrated malware in the course of developing CAIRN. That figure suggests ClosedQuorum is less an anomaly than an early, documented instance of a pattern that is already forming across the threat landscape.
The combination of multi-model voting, autonomous decision-making, and commodity exfiltration via Discord points to a class of malware that trades technical depth for operational convenience. Whether or not ClosedQuorum itself sees deployment, the blueprint it represents is now documented and, through criminal forum activity, demonstrably circulating in communities that have an interest in using it. Cisco Talos plans to continue tracking AI-integrated threats through the CAIRN framework.
