CLOSEDQUORUM: Windows Malware Where Four AI Models Vote on Every Move
Cisco Talos has disclosed CLOSEDQUORUM, Windows malware that asks 4 commercial AI models to vote on its next move and acts with no human in charge, and the habits security teams built around reading human attackers are losing value as a result.
Key Takeways
- Cisco Talos disclosed CLOSEDQUORUM on September 22, 2026, the first reported fully autonomous Windows malware control system, which lets 4 commercial AI models vote on its next action.
- Detection habits built on reading a human attacker's schedule and style lose value against malware whose decisions come from a rotating vote of AI models.
- Behavioral detection, which watches what a program does on the machine regardless of who decided it, holds up better against this design than rules matched to known attacker patterns.
- No in-the-wild deployment has been confirmed, which gives security leaders a head start on retraining their teams before any incident.
On September 22, Cisco Talos disclosed Windows malware that asks 4 commercial AI models what to do next, counts their votes, and carries out whatever wins. Talos calls it CLOSEDQUORUM, and nobody sits behind it making the decisions.
The report, written by Talos researcher Ryan Fetterman, describes it as the first reported fully autonomous Windows malware control system. Every security team has an analyst who can glance at a traffic log and tell you the attacker stepped away for lunch. That analyst is the person this disclosure affects most, and the report also carries one detail that works in their favor.
A vote among 4 AI models replaces the human at the keyboard
Classic malware reports to a person. The attacker runs a command server, the infected machine checks in, and someone on the other end chooses the next step. CLOSEDQUORUM hands that choice to a committee. It describes its situation to up to 4 public AI services, DeepSeek, Qwen, Mistral, and Google Gemini, and each one proposes an action. The option with the most votes runs. Ties follow a fixed order, with DeepSeek first, then Qwen, Mistral, and Gemini, and if none of the 4 answers, the malware sleeps and tries again later.
The choices on that ballot are serious ones. With no one steering, it can pull credentials out of Windows memory, lift saved passwords from Chrome, Edge, and Firefox, and copy data from MetaMask, Exodus, and Ethereum wallets. It can also inject its code into other running programs and dig in for the long term through registry entries, scheduled tasks, or WMI event subscriptions.
The 4 AI providers are bystanders in this account. A malware author pointed their public APIs at work they were never offered for, the same way criminals misuse any cloud service. The lesson here belongs to defenders.
The habits defenders built around human attackers are losing value
A good SOC analyst spends years learning how attackers behave. They learn that people keep hours, so a long pause between check-ins can point to a time zone or a moment of doubt. They learn one adversary's habits, which tools that person favors and in what order, and they write playbooks designed to catch that personality. Much of threat hunting comes down to reading a person through their traffic.
CLOSEDQUORUM gives the analyst no person to read. Its decisions come from a rotating quorum of models that can settle on a different tactic from one step to the next, with no schedule and no house style. A pause means the APIs went silent. A change in approach means the vote moved. Those hard-won instincts still serve well against human crews, and against this design they lose value with every step it takes.
Attackers used to have habits. CLOSEDQUORUM has a ballot.
This is the half-life of skills, the idea running through my writing on agentic AI: the interval between learning something and watching it go obsolete keeps shrinking. I have followed it in commerce, where Amazon sellers were using AI before Seller Central caught up, and inside the labs themselves, where Claude now leads 26% of Anthropic's own AI research and development work. Security makes the point harder to ignore, because here the skill decays while an adversary is testing it.
Hollywood lived through a version of this in 1927. Sound arrived with the talkies, and within about 2 years, silent-film actors who had spent careers perfecting gesture found the studios listening to their voices instead. Some trained those voices and kept working. Others waited for silence to come back, and it never did.
No confirmed deployment is the best news in the report
The detail that favors our analyst sits near the end of the disclosure. Talos found CLOSEDQUORUM through its CAIRN research project, by hunting, and no deployment in the wild has been confirmed. Development artifacts tie its author to criminal carding-forum posts going back to 2025, so the intent is real. The timing still belongs to defenders. Security leaders rarely get a clear look at a new attack design before it reaches their own network, and this is one of those times.
Advance warning is worth something only when someone spends it. These are the questions I am taking into my own conversations with security and technology leaders, and you are welcome to borrow them.
Does our detection watch behavior or history? Signature and pattern rules catch what someone has seen before. Behavioral and anomaly detection watches what a program does on the machine, whoever made the decision: a process reading Windows memory for credentials, an unfamiliar program opening browser password stores, a scheduled task nobody created, or a new WMI subscription appearing overnight. Those actions look the same whether a person or a vote chose them.
Which of our machines should be talking to AI services at all? A finance workstation calling 4 different model providers in quick succession deserves a look. Ask whether your team keeps a list of which machines and programs have a business reason to reach those APIs, because that list pays off against this threat and against ordinary shadow AI too.
When did our analysts last train against an attacker with no habits? Most tabletop exercises assume a human adversary with a rhythm. Run one where the attacker changes tactics at every step and never breaks for lunch, then see which playbooks still hold.
Are we retraining before the incident or after it? Retraining after a breach happens under pressure, with budget that arrives too late to help. Retraining now happens with a clear head, and CLOSEDQUORUM just handed every security leader the reason to start.
The people behind the playbooks deserve the first investment
Behind every playbook is a person who built a career on knowing how attackers think, and that expertise pays mortgages and college tuition. Their judgment still matters, while the attacker they learned to read keeps changing shape. Organizations that fund their retraining now keep their best people relevant, and those people keep the company safe. This is the argument at the heart of my forthcoming book, The Great Relearning: in an economy increasingly run by agents, the most durable skill is the capacity to relearn.
Attackers now have a committee that can change its mind at every step. Defenders still have people, and people can learn. Take one question into your next security review: which of our detection rules assume a human on the other end? I'm easy to find if you want to compare notes.
What was CLOSEDQUORUM's original name?
The malware was initially named BALZAK internally before it became public as CLOSEDQUORUM, so security teams checking threat-intelligence feeds or older notes should search for both names.
Can blocking AI services stop malware like CLOSEDQUORUM?
Blocking can stall it, and stalling is the limit of what it does. When none of the 4 AI providers answers, CLOSEDQUORUM sleeps and retries, so the infection stays on the machine and waits. Blocking every major AI provider across a company is also hard to sustain, since legitimate teams use them daily. A narrower approach works better: decide which machines and programs have a business reason to reach AI APIs, alert on everything else, and treat an unexplained AI call from an endpoint as a reason to investigate the machine itself.
Where can I read the original CLOSEDQUORUM research?
The primary source is the Cisco Talos blog post by researcher Ryan Fetterman, published September 22, 2026. Within days it was covered independently by outlets including BleepingComputer, The Register, and The Hacker News.
Here is what makes Alex a credible voice on this topic: Alex shaped Cisco's $1.1B innovation portfolio over 20 years as former Managing Director of Innovation Strategy and Head of Global Innovation Centers, and today he helps leaders plan how their teams relearn when agentic AI rewrites the rules of their work, including the work of defending a network.
Planning how your security and technology teams retrain for autonomous AI threats? Invite Alex to speak with your leadership team →
.svg)
