Cisco Talos cybersecurity experts have discovered a new Windows malware called CLOSEDQUORUM that uses multiple large language models to make decisions on infected devices. The discovery marks a new level of cyberthreat as artificial intelligence moves from being a hacker’s tool to a full-fledged part of the attack infrastructure.
Cisco Talos cybersecurity experts have discovered a new Windows malware called CLOSEDQUORUM that uses multiple large language models to make decisions on infected devices. The discovery marks a new level of cyberthreat as artificial intelligence moves from being a hacker’s tool to a full-fledged part of the attack infrastructure.
The malware is designed to steal credentials and cryptocurrency. The main feature of CLOSEDQUORUM is the use of four AI services at once: DeepSeek, Qwen, Mistral, and Google Gemini, TechSpot writes .
Before performing the next action, the program consults with the specified chatbots. It has no built-in mechanism for a human operator - the program operates completely autonomously.
If one of the AI services becomes unavailable, CLOSEDQUORUM switches to the others, continuing to execute its algorithm.
The program evaluates the models' responses and does not execute commands that it considers unreliable or incorrect.
“Initially, everyone saw AI as a productivity tool. Now we’re seeing it operationalized. For attackers, it’s an opportunity to run more campaigns and reach more computers by having an intelligent module in the background that can ask questions and get answers,” said Matt Olney, senior director of threat research at Cisco Talos.
CLOSEDQUORUM was discovered thanks to the launch of a new analytical tool from Cisco Talos, the open framework CAIRN (Cognitive Artifact Intelligence Research Network). It analyzes the technical “digital fingerprints” left by the integration of artificial intelligence in malware code.
CAIRN development manager Ryan Fetterman reported that during testing of the system, about 20 new samples of malware with integrated AI were found, although only isolated cases had previously been described in public access (for example, LAMEHUG, discovered by CERT-UA in July 2025).
Researchers emphasize that the use of AI in cyberattacks is still in the experimental stage, but the emergence of tools like CLOSEDQUORUM gives security experts an important signal about what the autonomous hacking systems of the future will look like.
