Malware Lets Four AI Models Vote on What to Steal Next

Key points

• Cisco Talos disclosed CLOSEDQUORUM on 22 September 2026, a Windows malware sample that asks up to four AI models to vote on its next move instead of calling home to a human operator.
• The malware was found through CAIRN, a new Talos toolkit that hunts AI-integrated malware by the strings it leaves behind: prompt templates, API keys and jailbreak phrases.
• Talos says it has not seen CLOSEDQUORUM used in a real attack, and the public sample does not run as-is.
• If the models agree, the malware can grab Windows login details, saved browser passwords and cryptocurrency wallet files.
• Artifacts in the binary tie the developer to carding forum posts, where criminals trade stolen card data, going back to 2025.

Cisco's Talos research team has published details of an odd little Windows program called CLOSEDQUORUM. Instead of waiting for instructions from a criminal sitting at a keyboard, it asks a panel of AI models what to do.

Up to four models get a vote. If a quorum agrees, the malware acts.

Talos posted the full writeup on 22 September 2026 and stresses two caveats up front: they haven't caught anyone using it in a real attack, and the public copy of the binary won't run as delivered. We first covered this disclosure the following day in "CLOSEDQUORUM Runs Its Own Attack Without Asking Anyone".

So this is a laboratory find, not a live outbreak. It still matters.

What does the malware actually do?

On a machine it has infected, CLOSEDQUORUM can steal three things: the credentials a person uses to log into Windows, the passwords a browser has saved, and the wallet files used by cryptocurrency apps. Standard infostealer fare, the kind of theft that feeds account takeover fraud.

The unusual part is who decides when to steal what. Most malware talks to a command and control server, known as C2, which is just a machine the attacker owns and uses to send orders. CLOSEDQUORUM replaces that server with a call to several AI models, feeds them a constrained menu of choices, and acts on the majority answer.

Talos calls this "effort displacement": the human operator steps out of the loop for whole stretches of the attack. The AI isn't writing clever new code on the fly. It's picking from a short list the developer already wrote.

How was it found?

Talos found it with a new toolkit they're also releasing, called CAIRN, short for Cognitive Artifact Intelligence Research Network. The name nods to the little stacks of stones hikers leave to mark a trail.

Malware that plugs into AI services leaves its own stones behind: prompt templates, provider endpoints and API keys. Jailbreak phrases meant to talk models past their safety rules. CAIRN scoops those strings out of binaries and links samples together by them, without needing to run the code.

That metadata trail is how Talos connected the CLOSEDQUORUM author to postings on carding forums, online marketplaces for stolen payment card data, going back to 2025. As first reported by The Hacker News, the sample itself does not execute in its published state.

Should ordinary people worry yet?

Not from this specific sample. It doesn't run. Nobody's been hit with it.

The honest read is that this is a proof of concept a small crimeware developer thought was worth building. The architectural shift is what's interesting. If the model panel makes the operational calls, the attacker doesn't need to be online, doesn't need a stable C2 server, and each infection can behave a little differently. Defenders who look for one hard-coded server address or one predictable command pattern have less to grab onto. Our earlier piece "AI Malware Is Real. It Is Also Mostly Hype." from 26 August found that of 405 samples studied by Palo Alto Networks, only 12 reached a real computer and existing defences caught all of them. CLOSEDQUORUM hasn't cleared even that bar yet.

Multifactor authentication wouldn't have blocked this stage of the attack, because the malware is stealing session material after a user has already signed in. Keeping infostealers off the machine matters more here: patched browsers, disciplined downloads and endpoint protection that flags credential theft attempts.

What I'll be watching: whether the next AI-integrated sample CAIRN surfaces actually runs, and whether the model providers named in those embedded API calls start cutting the keys off faster than developers can rotate them.