AI
The Implant That Holds a Vote, Inside the First AI Directed Attack
Cisco Talos just documented something the security world has been waiting to see. A Windows implant that hands its next move to a panel of four commercial AI models and lets them vote. The implant is called CLOSEDQUORUM, and its discovery marks the first publicly described malware that delegates command decisions to large language models instead of a human operator or a classic command server.
The mechanics are elegant in a way that should sharpen every defender's attention. CLOSEDQUORUM is a 16.4 megabyte executable written in Go. After it lands on a machine, it gathers reconnaissance, builds a prompt, and sends it to DeepSeek, Alibaba's Qwen, Mistral, and Google's Gemini. Each model answers in typed JSON with one of a few fixed choices, steal, inject, or persist. The implant counts the votes and runs the winner. Ties go to DeepSeek first, then Qwen, Mistral, and Gemini in order. The models are instructed that they are an advanced malware strategist and told to provide only executable decisions.
Here is the angle most coverage will miss. A single model's safety guardrails can refuse a malicious prompt. A voting panel of four models is structurally built to route around any single refusal. If one provider declines, three still vote, and the majority still acts. That property belongs to the architecture itself, spread across the whole panel. It is also why Talos researcher Ryan Fetterman frames the discovery as a shift in attacker economics. The operator can walk away from the console. The implant keeps working while the operator sleeps, in his words, and the effort that used to flow into infrastructure now flows into reasoning.
The target list is worth your attention if you hold crypto. The steal module dumps credentials from LSASS, pulls browser credentials from Chrome, Edge, and Firefox, and extracts crypto wallets from MetaMask, Exodus, and Ethereum wallets. Exfiltration runs over a Discord webhook with AES-256-GCM encryption and base64 encoding. Talos holds the analyzed sample at the proof of concept stage. It shipped with placeholder API keys and a placeholder webhook, and Talos believes the developer intends to distribute it as a service, with each operator's real credentials injected at compile time. Forum artifacts linked the developer to carding discussions dating back to 2025.
The good news arrives in the same disclosure. Talos found CLOSEDQUORUM with CAIRN, the Cognitive Artifact Intelligence Research Network, an open source toolkit released the same day that hunts AI integrated malware by scanning metadata for prompt templates, provider endpoints, API key prefixes, and jailbreak terms, using static analysis that leaves the binary unopened. Because the implant talks to legitimate AI providers and Discord, old fashioned domain blocking loses its punch, so Talos recommends behavioral detection instead. Watch for AI provider API traffic from an unfamiliar Windows executable, similar requests to several models in a short window, and Discord webhook traffic from the same process combined with known malware techniques like process injection. Autonomy comes with its own tradeoffs. As the Talos report concludes, autonomy trades human limitations for model and infrastructure limitations, and defenders who watch behavior instead of domains hold the stronger hand.
The builders get the final word here. Open source defense tooling that spots AI driven malware before it executes is exactly the kind of asymmetric response the industry needed, and CAIRN arriving alongside the disclosure means every security team can start hunting this pattern today.
Quick answers
What is this story about?
Cisco Talos just documented something the security world has been waiting to see. A Windows implant that hands its next move to a panel of four commercial AI models and lets them vote. The implant is called CLOSEDQUORUM, and its discovery marks the first publicly described malware that delegates command decisions to large language models instead of a human operator or a classic command server.
Why does this story matter?
The builders get the final word here. Open source defense tooling that spots AI driven malware before it executes is exactly the kind of asymmetric response the industry needed, and CAIRN arriving alongside the disclosure means every security team can start hunting this pattern today.
Sources
New to crypto? Read the crypto glossary, browse frequent questions, read our story, or explore the story archive.