ClosedQuorum's AI-driven decision panel
Cisco Talos researchers analyzed a new Go-based Windows implant they call ClosedQuorum that uses multiple commercial and third-party AI models to make post-compromise tactical decisions without any human operator issuing commands. The malware queries reconnaissance data from an infected host and then sends those inputs to a panel of models — Google Gemini, DeepSeek, Qwen, and Mistral — which vote on the next action.
Talos describes ClosedQuorum as the first publicly documented Windows implant to delegate tactical command-and-control (C2) decisions to a panel of AI models, and notes this design removes the need for a human to guide the attack at each step.
Voting rules and model priority
The malware implements a simple voting system among the four models to choose its next action. When votes are tied, the system applies a fixed priority order to break the tie. Talos reports that DeepSeek has final priority, followed by Qwen, Mistral, and Gemini.
- Voting among models decides the chosen action.
- Tie-breaking priority: DeepSeek → Qwen → Mistral → Gemini.
The cyber insurance questionnaire just landed. Now what?
SOC 2, HIPAA, insurance renewals - someone has to own security strategy. Nubivance provides fractional CISO leadership without the full-time salary.
Get a security leadPredefined tactical actions: steal, inject, persist, move
ClosedQuorum does not produce arbitrary, freeform outputs; Talos found the models are restricted to a predefined set of decisions. The analyzed binary includes handlers or logic for three of those choices and references a fourth:
- steal — simultaneously runs LSASS credential dumping, browser credential theft for Chrome, Edge, and Firefox, and cryptocurrency-wallet extraction targeting MetaMast, Exodus, and Ethereum wallets;
- inject — generates shellcode and attempts code execution using either process hollowing or Early Bird APC injection;
- persist — executes the malware’s persistence module;
- move — listed as a possible lateral movement decision, but the distribution build Talos analyzed lacks a corresponding handler and therefore cannot perform that action.
When the operation selects “steal,” the collected credentials and asset data are packaged and sent onward to the operators.
Automation and exfiltration: Discord webhook and build details
Talos reports that the stolen details are transmitted to operators via a Discord webhook, meaning that aside from initial malware delivery, the attack chain can proceed fully automatically. The binary the researchers examined contains placeholder API credentials and a dummy Discord webhook; those values can be replaced in bespoke ClosedQuorum builds to point to live infrastructure.
The researchers discovered ClosedQuorum using CAIRN, an open-source toolkit Talos released to help analysts track and study AI-integrated malware.
Operational limits, development attribution, and risk assessment
Cisco Talos highlights both advantages and constraints of ClosedQuorum's design. The removal of a human operator accelerates the attack chain and increases the potential scale of operations, Talos says, but it also introduces dependencies and failure modes tied to commercial AI services. Specifically, the researchers note that rate limits, malformed outputs, or temporary unavailability of the commercial APIs the system relies on can impede or halt decision-making.
Talos characterizes the implant as not particularly sophisticated in its coding or capabilities and says it is unclear whether the project is a test or an experiment. Still, the researchers warn it represents an “architectural shift towards attack-chain automation.” They also used artifacts from the binary to link the developer to postings on criminal forums related to carding dating back to 2025, though they have not confirmed in-the-wild deployment.
What this means for technologists and security teams, policymakers, and end users
Technologists and security teams should watch for AI-model-driven decision logic in post-compromise behavior, and for signs that exfiltration flows lead to ephemeral services such as webhooks that can be swapped in and out of builds. Detection efforts may need to account for orchestration that removes human timing and replaces it with API-dependent automation.
Policymakers and procurement leaders may want to note the reliance on commercial AI APIs and the consequences of rate limits and vendor availability; those dependencies are a core constraint referenced by Talos and can shape both defensive planning and regulatory conversations about API access and abuse prevention.
End users and organizations should be aware that the “steal” action in ClosedQuorum explicitly targets standard credential stores and specific cryptocurrency wallets — LSASS, Chrome, Edge, Firefox, and wallets named in the binary — and that a fully automated chain can forward stolen data without further operator interaction.
ClosedQuorum illustrates an evolution in malware architecture: delegation of tactical choices to model ensembles that can act faster and at scale, but also depend on external AI services and configuration choices that determine whether a build is inert or operational. Talos’ CAIRN toolkit provided the trace that uncovered this implant; whether ClosedQuorum remains an experiment or becomes broadly deployed depends on actors replacing placeholder credentials and the operational reliability of the commercial APIs it calls.
