conv.

All stories
SecurityQuiet · 41h

Cisco Talos reveals CLOSEDQUORUM, malware governed by AI voting panel

Windows credential stealer delegates tactical decisions to four commercial LLMs querying every five to 15 minutes with no human operator.

newest coverage 1d agosummary written 21h ago2 pieces Newswires

What to know

  • CLOSEDQUORUM is the first publicly documented malware delegating tactical decisions to an AI voting panel—four commercial LLMs (Gemini, DeepSeek, Qwen, Mistral) query every 5–15 minutes with no human operator in the loop.
  • Cisco Talos released CAIRN, an open-source detection framework that found CLOSEDQUORUM and 20 other AI-integrated malware examples by searching metadata for AI artifacts without executing binaries.
  • The malware has not been deployed in active attacks; six samples suggest a credentials-as-a-service operation where developer and buyer are separate actors.
  • The shift represents effort displacement: AI panels operate indefinitely across attention and working-hours limits that constrain human operators, raising questions about the speed and scale of future autonomous attacks.

“CAIRN gives defenders a way to track AI-specific traces before autonomous malware is widespread, while CLOSEDQUORUM shows that bounded attack decisions can already be handed to commercial models.”

RuntimeWire, Reporter summary · RuntimeWire ↗

Ryan Fetterman Security researcher, CAIRN lead developerCisco Talos Threat Intelligence Threat research groupUkraine's CERT-UA National cybersecurity authority

Cisco Talos reveals CLOSEDQUORUM, malware governed by AI voting panel
siliconangle.com

How it unfolded 1 development · click the chart to see its coverage articles

Peak 2 pieces in one hour at Sep 22, 7 AM; 2 pieces over 42 hours (2 articles) Sep 22, 7 AM — 2 pieces · 2 articles — Newswires 2Sep 22, 8 AM — quietSep 22, 9 AM — quietSep 22, 10 AM — quietSep 22, 11 AM — quietSep 22, 12 PM — quietSep 22, 1 PM — quietSep 22, 2 PM — quietSep 22, 3 PM — quietSep 22, 4 PM — quietSep 22, 5 PM — quietSep 22, 6 PM — quietSep 22, 7 PM — quietSep 22, 8 PM — quietSep 22, 9 PM — quietSep 22, 10 PM — quietSep 22, 11 PM — quietYesterday, 12 AM — quietYesterday, 1 AM — quietYesterday, 2 AM — quietYesterday, 3 AM — quietYesterday, 4 AM — quietYesterday, 5 AM — quietYesterday, 6 AM — quietYesterday, 7 AM — quietYesterday, 8 AM — quietYesterday, 9 AM — quietYesterday, 10 AM — quietYesterday, 11 AM — quietYesterday, 12 PM — quietYesterday, 1 PM — quietYesterday, 2 PM — quietYesterday, 3 PM — quietYesterday, 4 PM — quietYesterday, 5 PM — quietYesterday, 6 PM — quietYesterday, 7 PM — quietYesterday, 8 PM — quietYesterday, 9 PM — quietYesterday, 10 PM — quietYesterday, 11 PM — quietToday, 12 AM — quiet 1
8 AM4 PMyesterday8 AM4 PMnow · 1:58 AM ET
  1. 1

    CAIRN framework found 20 additional AI-integrated malware examples beyond nine known families

    After several months of development and use, CAIRN surfaced about 20 additional examples of AI-integrated malware beyond the nine named families documented in public record. CAIRN searches metadata for provider endpoints, embedded prompts, API-key prefixes, local-model runtimes, evasion strings and function-calling syntax without requiring samples to be downloaded or executed.

    “The session is closed; no humans are admitted. Four models are queried in sequence, their independent verdicts tallied, and the binary acts, based on their judgment.”
    — Ryan Fetterman, Talos researcher · source
    1. 2 outlets Cisco Talos finds malware that puts its next move to a four-model vote

      first by SiliconANGLE, 1d ago · also RuntimeWire

      1 more headline
  2. background

    Talos finds no evidence of CLOSEDQUORUM deployed in active attacks — Six CLOSEDQUORUM samples covering about a week of the developer's build chain have been collected. Artifacts tie the developer to criminal forum accounts posting about carding since 2025, suggesting a credentials-as-a-service operation where the developer builds customized binaries and a buyer handles delivery. No active deployments have been documented.

  3. background

    CLOSEDQUORUM details emerge: four-model voting system with DeepSeek tie-break — CLOSEDQUORUM queries Google Gemini, DeepSeek, Qwen, and Mistral every five to 15 minutes under a system prompt identifying them as an "advanced malware strategist." Decisions with the most votes win; DeepSeek holds the tie-break. The 16.4-megabyte Go binary steals Windows credentials, injects code, establishes persistence, and moves laterally based on the AI panel's verdict.

  4. background

    Cisco Talos releases CAIRN framework and discloses CLOSEDQUORUM malware — Cisco Talos released CAIRN (Cognitive Artifact Intelligence Research Network), an open-source framework for finding AI-integrated malware, on September 22nd. The framework identified CLOSEDQUORUM, a Windows credential stealer that delegates tactical decisions to a panel of four commercial large language models.

  5. background

    Fetterman begins building CAIRN detection framework — After reviewing the public record in summer 2026 and finding about nine named malware families with AI integration, researcher Ryan Fetterman began building a detection system that could search for AI markers at scale.

  6. background

    Ukraine's CERT-UA documents LAMEHUG, first AI-integrated malware — Ukraine's CERT-UA documented LAMEHUG, malware that contacted Qwen2.5-Coder-32B-Instruct through a Hugging Face API to obtain commands. This disclosure prompted researcher Ryan Fetterman to anticipate a wave of AI-integrated malware.