Cisco Talos just documented the first Windows malware that doesn't wait for a human to tell it what to do next, it asks a panel of language models instead, and goes with majority rule.
Most malware still works the way it always has: a human operator sits on a command-and-control server, decides what the infected machine should do, and sends the instruction. That loop has a built-in speed limit, because it's bounded by a person's attention span, working hours, and how many infected machines one operator can babysit at once. CLOSEDQUORUM, disclosed by Cisco Talos in September 2026, is the first publicly documented case of malware that removes that limit — not by getting smarter code, but by handing the decision-making itself to AI.
What it actually is
CLOSEDQUORUM is a Go-based Windows implant. Once it lands on a machine, it doesn't check in with an attacker-controlled server for orders the way traditional command-and-control malware does. Instead, it gathers context about the host it's sitting on and asks four different large language models — DeepSeek, Qwen, Mistral, and Google Gemini — to independently vote on what it should do next, choosing from a fixed menu of options: steal credentials, inject code into another process, establish persistence, or move laterally to another machine.
Each model responds independently in a strict, predefined JSON format. Whichever action gets the most votes is the one that runs. If the vote ties, DeepSeek's answer wins by default, followed by Qwen, then Mistral — an oddly bureaucratic detail for something built to compromise a machine, but it's a real design choice: the malware needs a deterministic way to resolve disagreement among four models that don't always agree.
What it does once it decides
The steal option dumps LSASS memory (a classic technique for harvesting Windows credentials), pulls saved passwords out of Chrome, Edge, and Firefox, and grabs cryptocurrency wallet data. The inject option uses process hollowing or Early Bird APC injection — both established techniques for running malicious code inside the memory space of a legitimate, already-trusted process, so it doesn't show up as a suspicious new executable. The persist option runs modules meant to survive a reboot. The move option, for lateral movement to other machines on the network, was present in the code Talos analyzed but non-functional — worth noting, because it means the "fully autonomous attack" is currently bounded to a single compromised host, not yet a self-propagating worm.
Whatever gets stolen is exfiltrated through a Discord webhook, encrypted, and dropped into a channel the operator controls. That's also where the human comes back into the picture: someone still has to build the malware, configure each copy with their own API keys and webhook at compile time, deploy it, and eventually sit down and decrypt the results. The AI runs the tactical decision loop. It doesn't run the business.
Why this is a real architectural shift, not just a buzzword
The meaningful change isn't "malware used AI" — attackers have used AI to write phishing emails and obfuscate code for a couple of years now. It's that the decision of what to do next during an active compromise — traditionally the single most human-dependent part of an intrusion — has been delegated to a model. As one security analyst covering the disclosure put it, human operators are bound by attention, working hours, and cognitive load; a panel of models voting in a loop isn't. That's the entire value proposition of the design: not smarter attacks, just attacks that don't need a human awake and paying attention to keep moving.
It's also, refreshingly, not invincible. The malware depends on live API access to four external LLM providers — which means rate limits, an outage at any one provider, or a malformed model response can stall or crash the decision loop entirely. That dependency is also the best lead defenders have.
What it means for the people whose job is stopping this
For defenders, the practical shift is what you look for. Blocking known malicious domains doesn't help much here, because the malware is calling legitimate, widely-used AI APIs — the same ones your own developers might be using. The signal isn't that a process is talking to DeepSeek or Gemini; plenty of legitimate software does that. The signal is a process talking to several AI providers in the same session while also touching LSASS, injecting into a suspended process, or creating a new WMI persistence entry. Individually, none of those things is remarkable. Together, in that combination, they're not something a normal application does. That pushes detection further toward behavioral analysis — watching what a process does across several actions — and further away from static signatures or domain blocklists, which is a genuinely harder discipline to build a SOC around, and not one every team is currently staffed for.
For the offensive side, the barrier that's lowering isn't "can I write malware" — this still required real skill to build. It's "can I run a sophisticated, adaptive intrusion without personally staying online to steer it." That's the same labor-multiplying effect AI has had everywhere else, applied to a place most people didn't expect it yet: it doesn't require a more skilled attacker, it requires less continuous attention from the attacker that exists. A single operator can plausibly run more simultaneous compromises, for longer, with less hands-on-keyboard time per victim.
Neither side of this replaces a person outright. It changes what the person is for. The attacker stops being a tactician making moment-to-moment decisions and becomes someone who builds, deploys, and periodically checks in — supervision, not execution. The defender who used to write detection rules against known indicators has to increasingly write detection logic against behavioral patterns of a decision-maker, human or otherwise. That's a heavier, more analytical skill than a lot of current SOC tooling was built to support, and it's a fair bet that the security teams who adapt their detection philosophy first — rather than waiting for a signature to exist for "AI-directed malware" — are the ones who'll actually catch the next version of this before it finishes its job.
Top comments (0)