Malware Uses AI Models to Decide Next Move

Cisco Talos has discovered a Windows implant called CLOSEDQUORUM that delegates decision-making to up to four AI models instead of an attacker's command-and-control server.

The malware, which is at least three months old, asks commercial AI services - DeepSeek, Qwen, Mistral, and Google Gemini - to choose its next action from a fixed list: steal, inject, persist, or move.

The AI models receive basic facts about the infected computer and must respond in a precise format. The malware counts the votes and carries out the action with the most support.