Cisco Talos has found a Windows malware design that puts its next move to a vote. CLOSEDQUORUM asks up to four commercial AI providers which action to take, then routes the winning answer to a built-in capability. The September 22 report describes an unusual way to automate credential theft—but it does not establish an active outbreak.
Talos has not confirmed deployment in real attacks. Its public distribution sample contains dummy API credentials and a dummy Discord destination, preventing the researchers from observing a complete end-to-end run. The discovery is about the architecture visible in the code, with supporting development builds, rather than a count of compromised computers.
A committee inside a Windows executable
The 64-bit Go program is designed to consult DeepSeek, Qwen, Mistral and Gemini in sequence. It supplies information about the host and asks for a structured decision. The action with the most votes wins; a tie favors the first participating provider in that order.
That detail matters more than the word “autonomous.” The program is not giving a chatbot unrestricted control of Windows. It translates a constrained answer into functions its developer already supplied. This differs from PROMPTFLUX’s use of Gemini for self-modification: here, AI is intended to select the next tactical action.
The ballot has a limited menu
The implemented choices cover credential collection, process injection and persistence. A fourth choice, move, appears in the menu but has no handler in the distribution build. If every provider fails, the fallback also lacks an action handler, so the loop waits and retries.
The revealing feature is the boundary between the model and the executable. The model supplies a decision and parameters; the executable determines which of those instructions it can actually carry out. A confident answer cannot create a missing capability. Refusals, unavailable APIs and malformed responses can still interrupt this arrangement.
Multiple providers offer redundancy, not guaranteed agreement or success. Calling it a voting system should not suggest that the models deliberate together, validate one another’s safety, or need a unanimous result. The code counts their independently returned choices.
Familiar theft behind an unfamiliar control loop
Talos identified code targeting Windows credentials, browser password stores and cryptocurrency wallet data, with Discord serving as the intended reporting and transfer channel. Development artifacts suggest the author could customize builds with an operator’s credentials. That proposed distribution model remains an assessment, not proof of a working criminal service.
The practical concern is that a trusted service name can appear in an untrusted program’s network activity. An AI provider or Discord connection does not, by itself, identify malware. Conversely, a connection to a legitimate domain does not explain why an unfamiliar executable is accessing credential stores.
What to investigate—and what this report cannot tell you
For defenders, Talos points to correlated behavior: unexpected AI API traffic alongside credential access, process injection or persistence, followed by Discord communication. The useful question is which process performed those actions and in what sequence. Blocking every AI domain would lose that distinction and disrupt legitimate tools.
For Windows users, this report is not evidence that opening an AI website infects a PC. It does not identify a confirmed delivery campaign or provide a population-wide exposure test. If you have a suspicious executable, a file reputation check can contribute evidence; a clean or unknown result cannot establish that the computer or its accounts are safe.
CLOSEDQUORUM makes one bounded change concrete: software can outsource the choice among existing malicious actions to model APIs. Its unfinished paths and inert public build are equally important parts of the finding.
References
- Fetterman, R. The Closed Quorum: Inside the first reported autonomous AI C2 implant. Cisco Talos, September 22, 2026.
