Cisco Talos Exposes CLOSEDQUORUM, First Malware Decided Jointly by Four AI Models

Original sourceSantage

Summary

Cisco Talos on September 22 disclosed a Windows malware implant called CLOSEDQUORUM whose decisions are made jointly by up to four commercial AI models (DeepSeek, Alibaba Qwen, Mistral, Google Gemini), acting on majority vote without human intervention. Talos said the version analyzed was a placeho…

Key points

This is the first malware sample to fully outsource decisions to multiple AI models, setting new concrete requirements for security teams' detection and attribution methods.
When attack decisions are produced by majority vote across multiple AI models, traditional signature-matching defenses fail, requiring a shift to metadata and behavior-pattern detection.
Enterprise security teams should monitor behavior that calls multiple AI providers at once, anomalous executables, and credential access, and evaluate adopting metadata-scanning tools like CAIRN.

SecurityAI

Editorial note

This page is Code & Chain's editorial summary of public sources. It may be prepared with AI assistance and published through an automated workflow. Refer to the original sources; this content is not investment, legal, or tax advice.