Cisco Talos researchers say they have identified Windows malware that plots its next moves by polling up to four large language models and taking orders from that hive mind \u2014 with no human command channel \u2014 WIRED reported Tuesday.<\/p>\n
Dubbed CLOSEDQUORUM, the tool checks with DeepSeek, Qwen, Mistral, and Google Gemini to build a consensus on what to do inside a target system. If one AI service is down, it still polls the others, creating redundancy so the system stays closed. Talos linked the sample to cybercriminal forum chatter about credit-card fraud going back to 2025; it is designed to steal login credentials and cryptocurrency. Researchers could not confirm who built it or whether it has been used in real-world attacks.<\/p>\n
The find came via CAIRN \u2014 Cognitive Artifact Intelligence Research Network \u2014 an open-source framework Talos shared Monday to fingerprint and classify AI-integrated malware. Lead researcher Ryan Fetterman said publicly named AI malware families were still scarce a year after Ukraine\u2019s CERT-UA warned about LAMEHUG, but CAIRN has since surfaced about 20 additional examples. \u201cNow what we\u2019re seeing is that it\u2019s becoming operationalized,\u201d said Matt Olney, senior director of threat intelligence at Cisco Talos.<\/p>\n