On September 22, 2026, Cisco Talos published an analysis of "CLOSEDQUORUM," a Windows malware sample that has multiple large language models (LLMs) vote on what to do next after a system is compromised. The design feeds endpoint information to the models, tallies up to four responses through a vote, and then triggers built-in functions such as credential theft or persistence. This reduces the need for attackers to issue instructions one by one from a control panel—but the publicly available sample contains placeholder API keys, and Talos states it has not confirmed either the full execution chain or any real-world deployment.
What's novel here isn't that AI was used to write the malware. Rather, a program already planted on an endpoint delegates the decision of what to do next on that machine to an external model. But if the scope of "autonomy" is stretched too far, both the sample's actual capabilities and the challenges facing defenders can be misread.
The Implemented Autonomy Is Limited to "Selection"
According to Talos's analysis, CLOSEDQUORUM is a Go-language executable for 64-bit Windows, weighing in at 16.4MB. On launch, it collects information such as the machine name, Windows version, CPU count, and whether it has administrator privileges, and incorporates this as target context in queries sent to the models. It queries up to four models—DeepSeek, Qwen, Mistral, and Google Gemini—in sequence, and adopts whichever action received the most votes among the responses. In case of a tie, the model queried earlier takes priority. If valid responses aren't obtained from all models, the malware skips invoking any attack function for that cycle and waits before retrying.
What the models can return isn't an arbitrary program, but structured JSON with a fixed schema. The executable reads a field called Decision and routes it to existing internal routines. In the publicly available version that Talos analyzed on September 22, 2026, only three of the four possible actions the model can choose—steal, inject, and persist—actually have corresponding execution logic; move has no implementation.
| Action Returned by Model | Execution Logic in Public Sample | Target/Function |
|---|---|---|
steal |
Present | Harvests credentials from Windows LSASS, saved credentials in Chrome/Edge/Firefox, and wallet-related data from apps like MetaMask and Exodus |
inject |
Present | Generates shellcode and injects it into another process as specified |
persist |
Present | Establishes persistence via registry Run keys, scheduled tasks, WMI event subscriptions, etc. |
move |
Absent | Listed as an option, but the publicly distributed sample has no corresponding execution logic |
Source: Cisco Talos's "Voting and decision schema" and technical appendix. The classification covers the Decision field and corresponding logic in the publicly distributed sample that Talos analyzed; it is not a table demonstrating that each function succeeded in an attack or caused an infection.
What this correspondence table shows is that the models are not infinitely expanding the range of possible attacks. For instance, when steal is selected, it triggers credential- and wallet-harvesting routines that are hard-coded into the executable. Even if the response is move, no lateral movement actually occurs. Delegating action selection to AI does not change the fact that what the malware can actually do is still limited to the functions built into the program.
No Evidence Yet of Actual Operation
Through reverse engineering, Talos confirmed a decision loop consisting of querying the models, tallying responses, and routing to functions. Development builds also reveal a mechanism for embedding per-user API credentials at build time. However, the API keys and Discord destination in the publicly distributed sample are placeholder values that would not function as-is. Talos itself explicitly states that it has not observed a complete execution chain running from model voting through to the exfiltration of stolen data.
The company estimates that developers create pre-configured executables for customers, who then distribute them separately. In this model, Discord is not a command center where attackers issue step-by-step instructions, but rather a destination for reporting the chosen action and sending collected data. The analysis also found a design where collected data is encrypted with a symmetric key derived from the date. However, these are configuration and operational inferences drawn from builds and code—they do not corroborate actual customer counts, infection numbers, or financial damage. Talos has not confirmed that this malware has been used in the wild.
The characterization as the "first autonomous AI malware" also has boundaries. Talos's own framing is that this is, as far as the company is aware, the first publicly reported Windows sample to use this approach for tactical action selection after intrusion. CAIRN's explanation, published by the company the same day, situates the search for AI-integrated malware as an ongoing effort dating back to LAMEHUG, reported in 2025. CLOSEDQUORUM cannot be regarded as the very first example of AI-enabled attacks in general.
Even Without a Dedicated C2 Server, Communications Remain
In conventional remote-control malware, attackers send commands to the malware from a dedicated command-and-control (C2) server. CLOSEDQUORUM's design shifts that tactical decision-making to commercial model APIs, then reports the outcome to the attacker via a Discord webhook. While this reduces reliance on a dedicated command server, it does not eliminate external communications or the human involvement required for initial setup and distribution.
Defenders also cannot rely on monitoring a single domain. Talos highlights the combination to watch for: an unexpected Windows executable connecting to multiple AI services within a short window, paired on the same machine with LSASS access, injection into another process, persistence mechanisms, and transmissions to Discord. The execution loop is designed with irregular intervals of 5 to 15 minutes. Communication with AI services or Discord by itself can also occur during legitimate business use. What matters is correlating which process is communicating with what it's doing on the endpoint. The content of prompts in transit is typically invisible without TLS decryption inspection or logging on the service provider's end.
CAIRN, the research tool Talos released, begins this investigation from a sample's metadata. It separates the process into stages: first collecting AI-related traces such as model connection endpoints and prompts, then examining combinations with attack behavior, and finally linking findings to confirmed malware families. It allows candidates to be narrowed down without downloading and executing the binary, but it is not a tool that judges something malicious based solely on AI-related strings. Talos itself acknowledges that the structure of distribution packages can produce misleading matches, and that reverse engineering of individual samples remains necessary for a final determination.
What Should Be Verified Next
CLOSEDQUORUM is a design example demonstrating that part of the "what to do after intrusion" decision-making, once handled by humans, can be shifted to current commercial models combined with a simple voting mechanism. At the same time, the publicly available sample doesn't reveal how much this design actually functions in real attacks. Model refusals or poor responses, the fixed tie-breaking priority, and unimplemented actions all remain as limits on this autonomy.
What would update this assessment is evidence that pre-configured samples have actually been distributed and executed, records of which model responses led to which actions, and outcomes observed on compromised endpoints. Until such evidence emerges, what the implementation reveals about future attack methods must be kept separate from the scale of observed damage. In the meantime, defenders can check whether they're able to trace dangerous endpoint operations and multi-service communications as behaviors of the same underlying process.