Cisco Talos, one of the world’s leading cybersecurity research teams, disclosed something new on September 22, 2026: a piece of malware that lets AI models vote on what to do next, instead of waiting for instructions from a human attacker. It is called CLOSEDQUORUM, and while it has not been confirmed to have attacked anyone yet, it points to where cyberattacks may be heading. Here is what it actually is, explained simply.
Quick Answer
- CLOSEDQUORUM is a Windows malware sample discovered by Cisco Talos, disclosed September 22, 2026
- Instead of taking orders from a human controlling it in real time, it asks up to four AI models to vote on its next move
- The models involved are DeepSeek, Qwen, Mistral, and Google Gemini
- It reportedly targets saved passwords, Windows login credentials, and cryptocurrency wallet data
- Talos has not confirmed this malware has actually been used in a real attack
- The version made public is a non-working template, missing key pieces needed to actually function
- Cisco Talos also released a free tool called CAIRN to help security teams detect this type of AI-linked malware
What Makes CLOSEDQUORUM Different
Normally, malware either runs on fixed, pre-programmed instructions, or it checks in with a server controlled by a human attacker, who decides what it should do next. CLOSEDQUORUM works differently. Once it is on a system, it sends information about that computer to four separate AI models and asks each one what action to take next. The models “vote,” and whichever action gets the most support is the one that runs. If the vote ends in a tie, DeepSeek’s answer wins by default.
This matters because it removes a human from that specific part of the process, the moment-to-moment decision making during an attack. It is important to be clear about what this does and does not mean. A person still had to build the malware, decide what actions it was allowed to choose from, and get it running on a computer in the first place. What changes is that once it is running, it no longer needs someone actively directing it during that phase.
What Can It Actually Do
Based on the sample Cisco Talos examined, the malware is built to be capable of a few specific actions, including stealing saved browser passwords, Windows login credentials, and data linked to cryptocurrency wallets. Researchers found that the AI models are not given free rein to do anything at all. They can only pick from a small, fixed list of pre-written actions, essentially choosing option A, B, or C rather than deciding on something entirely new.
Has This Actually Been Used to Attack Anyone
This is the most important caveat in the entire story. Cisco Talos has been clear that it has not confirmed this malware has been used in a real attack. The version that became public was incomplete. It shipped with placeholder login credentials for the AI services instead of working ones, and researchers found that only some of its intended actions actually had working code behind them. In its current public form, it would not function as a real threat.
Researchers were, however, able to connect pieces of the malware’s code to online forum posts linked to card fraud activity dating back to 2025, suggesting whoever built it has a history in cybercrime circles.
Why Cybersecurity Researchers Are Paying Attention
The concern is less about this exact sample and more about what it represents. It is one of the first documented cases of malware built to hand off real decision-making to commercial AI services, rather than just using AI to help write the malware itself, which is something that has already been happening for a while. Researchers describe it as a meaningful step in a trend they have been expecting for some time.
What Cisco Talos Did About It
Alongside disclosing CLOSEDQUORUM, Cisco Talos released a free, open-source tool called CAIRN, designed to help security researchers spot this new category of AI-linked malware. Rather than running suspicious files to see what they do, CAIRN scans for telltale signs, like connections to AI provider services or specific patterns tied to prompting AI models, making it easier to catch this kind of threat before it can be fully weaponized.
How to Protect Yourself
None of this changes basic cybersecurity advice, it just adds one more reason to follow it closely:
- Keep your operating system and antivirus software updated
- Avoid downloading files or software from sources you do not fully trust
- Use a password manager instead of letting your browser save passwords in plain form
- Turn on two-factor authentication wherever it is available, especially for banking and cryptocurrency accounts
- Be cautious with email attachments and links, even ones that appear to come from people you know
Frequently Asked Questions
What is CLOSEDQUORUM?
It is a Windows malware sample discovered by Cisco Talos that uses a vote among up to four AI models to decide what action to take next, instead of relying on a human attacker’s real-time instructions.
Which AI models are involved?
DeepSeek, Qwen, Mistral, and Google Gemini. If the vote among them ties, DeepSeek’s choice wins by default.
Has CLOSEDQUORUM actually infected any computers?
Cisco Talos has not confirmed any real-world attacks using this malware. The publicly analyzed version was incomplete and would not function as a working threat as released.
What was CLOSEDQUORUM designed to steal?
Based on Talos’s analysis, it was built with the ability to target saved browser passwords, Windows login credentials, and cryptocurrency wallet information.
What is CAIRN?
CAIRN is a free, open-source tool Cisco Talos released alongside this disclosure, built to help security researchers detect malware that relies on AI services like this one.
Does this mean AI models like Gemini or DeepSeek are unsafe to use normally?
No. This malware simply sends requests to these AI services the same way any regular app would. The AI providers themselves were not compromised or involved beyond responding to requests sent to them, the same as they would for any other user.
Should regular users be worried about this specific malware?
Since it has not been confirmed active in the real world, there is no immediate need for alarm. It is more relevant as an early signal of where cyberattacks may be heading, which is why security researchers are studying it closely now.
