The specimen Talos pulled apart never ran live — placeholder API keys, no confirmed real-world deployment. But the architecture is the story: the first documented case of malware delegating tactical decisions to AI entirely, a shift Talos calls “effort displacement”, and it upends assumptions a decade of detection playbooks was built on.

How the vote works#

On execution, the implant gathers basic host context — hostname, operating-system version, whether it holds admin privileges — and folds it into a prompt fired at each of the four models in turn. The prompt casts the model as an “advanced malware strategist” and demands “ONLY executable decisions,” constraining every reply to a typed JSON schema. Anything that doesn’t match the format is thrown out.

The models choose from a menu of four options: steal, inject, persist, and move. (The fourth is a dead end — defined in the code but with no function behind it.) The plurality vote wins; ties are broken by a fixed hierarchy — DeepSeek first, then Qwen, Mistral, Gemini. A model that refuses, goes offline, or returns malformed JSON simply loses its vote.

“Steal” is the payload that matters: three modules run at once — LSASS memory dumps, saved passwords from Chrome, Edge, and Firefox, and scans for crypto wallets like MetaMask and Exodus. “Inject” writes shellcode and picks the delivery method; “persist” sets the reboot-survival mechanisms. The loot is AES-256-GCM-encrypted, base64-encoded, and exfiltrated via a Discord webhook at randomized five-to-fifteen-minute intervals.

A laptop in a dark room with four translucent AI faces hovering above its screen and a world threat map behind, illustrating malware that consults AI models to pick its next action.
Illustration generated for AI Frontier Post.

Why this is a milestone, not just another sample#

Most AI-cybercrime discussion is about speed and scale: faster phishing, more variants, bigger campaigns. In all of it, a human still picks the targets. CLOSEDQUORUM is the first documented specimen that removes the human from an entire phase of the attack.

Talos calls this third dimension effort displacement: “It does not go offline when the attacker sleeps.” Every few minutes the implant consults the panel, tallies the votes, and acts — unattended, indefinitely.

The design is also incidentally resistant to each provider’s safety rails. Guardrails are enforced per model; the quorum votes across four, so if one model refuses on safety grounds, the other three still cast ballots. No single provider’s refusal policy functions as a backstop.

What Talos is careful not to claim#

The report is unusually careful about its own limits, and they matter:

  • The analyzed binary is inert. Placeholder API keys and a dummy webhook mean nobody has watched the live version run — and Talos has not confirmed any real-world deployment.
  • But earlier development builds tell a different story. Real credentials baked in at compile time point to a malware-as-a-service model: custom per-operator builds, each with its own keys and webhook, with the AI orchestration as the selling point.
  • The encryption is weaker than it sounds. The AES key is derived from the current date, so the developer could decrypt any operator’s stolen data just by knowing what day it is — obfuscation dressed up as security.
  • The developer has a trail. Artifacts link the person behind it to carding-forum posts dating back to 2025: a working criminal, not an academic demo.
  • And autonomy cuts both ways. Model refusals, rate limits, malformed outputs, and API account takedowns can slow or halt the attack entirely. “Autonomy does not make the implant infallible,” the report concludes, “it exchanges some human limitations for model and infrastructure limitations.”

How defenders are supposed to spot it#

CLOSEDQUORUM surfaced through CAIRN — the Cognitive Artifact Intelligence Research Network, a new open-source toolkit Talos released alongside the report to hunt AI-integrated malware by scanning metadata for prompt templates, provider endpoints, and orchestration logic, without executing binaries. This implant is its first case study.

With no attacker-owned domain to blocklist, Talos instead recommends hunting a cluster of correlated behaviors:

  • AI-provider API traffic originating from an unfamiliar Windows executable;
  • similar requests going out to several model providers in a short interval;
  • Discord webhook traffic from the same process or host;
  • combined with known malware techniques such as process injection or LSASS access.

No single signal is enough alone; together, Talos says, the combination is distinctive. The report ships with a YARA rule and a MITRE ATT&CK mapping so teams can start hunting immediately.

A security analyst’s workstation at night with a glowing network attack graph on the monitor, illustrating defenders hunting autonomous malware.
Illustration generated for AI Frontier Post.

What to watch#

Whether the pattern spreads. The components are off the shelf — commercial APIs, a voting loop, commodity credential-theft modules — so any crew can copy the architecture. If autonomous C2 goes from specimen to trend, detection shifts from infrastructure hunting to behavior correlation.

The best vantage point may belong to the model providers themselves. The structured prompts — host context paired with offensive-capability language — are visible to whichever API receives them, a telemetry stream no endpoint agent can match. The open question is whether providers will build detection for prompts that use their models as a malware committee.