ClosedQuorum Lets an AI Panel Choose What a Windows Implant Does Next

A newly documented Windows malware family called ClosedQuorum uses multiple artificial intelligence models to select its next action after compromising a system.

Written in Go, the implant sends reconnaissance information to Google Gemini, DeepSeek, Qwen, and Mistral. Their responses are converted into votes for a limited menu of malicious operations, including credential theft, code injection, and persistence.

The malware was reported on September 22, 2026. Cisco Talos describes it as the first publicly documented Windows implant known to delegate tactical command-and-control choices to a panel of AI models.

There is no confirmed evidence that ClosedQuorum has been deployed against real targets. The analyzed build also contains placeholders and an unfinished lateral-movement function, leaving open the possibility that it is an experiment rather than operational malware.

Reconnaissance becomes input for an AI vote

ClosedQuorum’s defining feature is not AI-generated malware code. It is the use of external models as a decision layer during the post-compromise phase.

Once running on a Windows host, the implant collects system reconnaissance data and submits that information to four supported model providers:

• Google Gemini
• DeepSeek
• Qwen
• Mistral

The models do not receive unrestricted control of the infected machine. Instead, ClosedQuorum asks them to choose among predefined decisions supported by the malware. This constraint limits what a model can initiate, even if its response contains unexpected or more ambitious instructions.

The models vote on the next stage. If their choices produce a tie, the malware resolves it through a hard-coded order of precedence:

1. DeepSeek
2. Qwen
3. Mistral
4. Gemini

That hierarchy makes the system deterministic when no option receives a clear majority. It also shows that the developer did not treat all model responses as equally authoritative.

The precise prompts, reconnaissance fields, and validation logic used to process model output have not been disclosed. It is therefore unclear how much context each service receives or how reliably the implant handles responses that differ from the expected format.

Four branches cover theft, injection, persistence, and movement

Cisco Talos identified four possible decisions in the analyzed build: Steal, Inject, Persist, and Move. Each represents a post-compromise objective rather than a free-form command.

The Steal branch targets several valuable sources of data. It can attempt to dump credentials from the Windows Local Security Authority Subsystem Service, or LSASS, and extract credentials stored by Chrome, Edge, and Firefox.

The same branch searches for cryptocurrency-wallet information associated with MetaMast, Exodus, and Ethereum. The available information does not describe the exact wallet files, browser extensions, or account artifacts targeted.

The Inject decision generates shellcode and tries to execute it using one of two established techniques: process hollowing or Early Bird APC injection. Both are intended to run malicious code within the context of another process, potentially making execution less obvious than launching a standalone payload.

Technical details about the target processes, shellcode source, and fallback behavior are not known.

The Persist branch invokes the implant’s persistence module. The specific persistence mechanism has not been disclosed, so defenders cannot yet rely on a known registry path, scheduled task, service name, or startup location associated with this malware.

Finally, Move appears to represent lateral movement. However, the analyzed build has no handler capable of carrying out that choice. A model can therefore vote for movement, but this version cannot execute it.

That missing implementation is one of several signs that ClosedQuorum may still be under development.

Discord remains the route back to the operator

Information collected from an infected system is transmitted through a Discord webhook. After that initial delivery, the AI-backed decision loop can continue selecting post-compromise actions without an operator issuing each command manually.

This does not make ClosedQuorum fully autonomous. It still depends on code written in advance, external AI services, working API access, and the malware modules available in the deployed build.

The architecture could nevertheless reduce the amount of attention required from a human controller. An operator might initiate an intrusion, receive the collected information through Discord, and allow the implant to choose subsequent actions from its fixed menu.

At scale, that model could support more simultaneous infections than an operation in which every compromised host waits for manual instructions. Speed and reduced operator workload are the principal risks—not a new exploitation capability.

The method of initial access is unknown. No vulnerable product, phishing mechanism, loader, or delivery chain has been identified, and the compatible Windows versions have not been disclosed.

The concept is more notable than the current implementation

Cisco Talos found ClosedQuorum using CAIRN, its open-source toolkit for identifying and studying malware that incorporates AI.

Researchers do not consider the sample technically sophisticated. Its novelty lies in coordinating several models and using a voting system to make tactical choices, rather than in advanced evasion, exploitation, or persistence.

The binary contains placeholder API credentials and a dummy Discord webhook. Those values would need to be replaced in a customized build before the implant could use real model accounts and return stolen information to an operator-controlled destination.

Its reliance on third-party AI APIs also creates failure points. Rate limits could delay or stop requests, while service outages could interrupt the decision process. Malformed or unexpected model output could prevent the malware from selecting a valid action.

Blocking access to the required APIs may also interfere with its operation, although Talos has not presented that approach as a tested mitigation. Such restrictions would need to account for legitimate organizational use of the same services.

It remains unclear whether ClosedQuorum is a proof of concept, a private test, or an incomplete malware project. Artifacts embedded in the binary reportedly connect its developer with criminal-forum discussions about carding dating back to 2025, but that connection does not establish real-world deployment of this implant.

Defenders have behaviors to monitor, but no published indicators

There is no patch for ClosedQuorum because it is a malware family rather than a product vulnerability. No specific configuration fix, file hash, domain, process name, or other formal indicator of compromise has been disclosed.

Defenders can instead focus on the behaviors required by its modules:

• Unauthorized access to LSASS or attempts to dump its memory.
• Unusual reading of credential stores belonging to Chrome, Edge, or Firefox.
• Access to cryptocurrency-wallet data without a legitimate business reason.
• Process hollowing and Early Bird APC injection activity.
• Unexpected persistence changes made by Go-based Windows executables.
• Outbound connections to Discord webhooks from endpoints or applications that do not normally use Discord.
• Unapproved API calls to Gemini, DeepSeek, Qwen, or Mistral from Windows systems.

Organizations that permit commercial AI services should distinguish approved applications and service accounts from unexplained endpoint traffic. Blanket blocking may be impractical, but authentication records, API usage, and network destinations can still expose anomalous access.

ClosedQuorum does not demonstrate an AI system independently inventing an attack campaign. It shows something narrower and immediately relevant: malware can outsource bounded post-compromise decisions to several models, compare their answers, and continue operating with less direct supervision.

The analyzed sample is incomplete. The architecture may matter more than the binary itself.