Cisco Talos unveils ClosedQuorum, malware designed to delegate its decisions to AI

On September 22, 2026, Cisco Talos published the architecture of ClosedQuorum, Windows malware designed to entrust the choice of its actions after infection to multiple AI services. Researchers detailed this delegation through reverse engineering and static analysis of the executable.

The analysis of ClosedQuorum accompanies the launch of CAIRN, Talos’s open-source tool dedicated to malware that integrates AI. The ClosedQuorum technical report lists six builds observed between December 29, 2025, and January 6, 2026. These traces document development predating the announcement.

CAIRN enabled Talos to identify ClosedQuorum by exploring VirusTotal metadata, including traces of prompts and AI provider addresses. This search selects candidates for further examination without downloading or executing their binaries.

A menu of actions and a vote among AI services

The binary examined is a 16.4 MB 64-bit Windows executable written in Go. It includes four integrations: DeepSeek, Alibaba’s Qwen via OpenRouter, Mistral and Google Gemini. The program is designed to query these services one after another.

The models must choose from a menu defined by the code and provide a structured response that the program can interpret. Up to four valid responses can participate in the vote. The code selects the action with the most votes without requiring a response from each of the four providers.

Talos identifies functions in the code for stealing credentials and digital wallet files. Other functions aim to inject code into a process or establish lasting persistence for the program on the machine. The menu also mentions movement to other machines, without a corresponding module in the distributed version.

The delegation described by Talos concerns tactical decisions on an already compromised machine. Victim selection and the full course of the infection are outside this loop.

In a conventional command-and-control architecture, an operator sends instructions from their infrastructure. ClosedQuorum is designed to obtain the choice of action from commercial AI services. The malware’s functions determine what it can execute.

Monitor the program that calls AI

In a functioning deployment, this delegation could allow the attacker to oversee more infections with less ongoing attention. The results published by Talos provide no measure of any gain in time or capacity.

For security teams, a domain belonging to a known AI provider does not guarantee the legitimacy of the process contacting it. Talos proposes correlating calls to multiple providers with credential access, code injection or mechanisms for persistence on the machine, possibly accompanied by exchanges with Discord. This approach could help assess the program without indiscriminately banning the AI tools used by employees.

Dummy parameters in the public binary

The public binary contains dummy API keys and a dummy webhook address, rendering model calls and exfiltration inoperative. Development builds contain traces of parameters injected at compile time, without establishing that four calls worked. Talos has not observed any complete end-to-end execution and does not confirm any real-world campaign.

The loop also depends on the providers’ responses. Model refusals, rate limits, delays and malformed responses can prevent an actionable decision from being obtained. If no provider supplies a usable response, the code is designed to wait and then try again.