Researchers uncover malware that uses AI to choose its next move
Cisco Talos documents CLOSEDQUORUM, a Windows implant that lets commercial LLMs vote on its next action.
Cisco Talos released CAIRN, an open-source framework that hunts AI-integrated malware using file metadata such as prompts, provider endpoints, and sandbox-evasion text, without executing samples. Its first highlighted find is CLOSEDQUORUM, a 16.4 MB Go Windows implant that asks DeepSeek, Qwen, Mistral, and Gemini to vote on stealing data, injecting code, or establishing persistence, with the goal of harvesting credentials and crypto wallets. The examined copy contained placeholder API keys and a dummy webhook, so researchers did not observe a complete live operation. Talos linked the broader hunt to LAMEHUG, which CERT-UA reported in July 2025 as an early AI-integrated malware sample.
- CLOSEDQUORUM is a 16.4 MB Go Windows implant without a dedicated C2 server.
- DeepSeek, Qwen, Mistral, and Gemini vote on the implant's next action.
- The fixed menu covers data theft, code injection, and persistence.
- The analyzed sample used placeholder API keys and was not run live.
- CAIRN classifies AI-malware artifacts from metadata without executing samples.
Full article679 words · extracted from helpnetsecurity.com · click to collapse
To help security practitioners catch malware that leans on AI, researchers from Cisco Talos shared an open-source framework that they hope will be used to classify and analyze the threat. The tool, called CAIRN, works entirely from metadata pulled off files. No downloading the malware, no running it.
CAIRN explorer connects malware binaries by metadata attributes like submitter, import hash, domain or AI provider (Source: Cisco Talos)
How CAIRN hunts
Researchers look for what Talos calls cognitive artifacts, the traces AI-integrated malware leaves in its code and file metadata: embedded prompts, provider API endpoints, orchestration logic, and evasion text written specifically to fool an AI-based sandbox scanner.
CAIRN sorts what it finds into three tiers. The first tier just confirms AI-related strings are present somewhere in a sample. The second adds behavioral context, spotting combinations of artifacts that suggest the AI integration is actually operational rather than incidental. The third tier is reserved for confirmed, named malware families.
“CAIRN uses four distinct analysis strategies; each suited to a different phase of investigation. In practice, a hunt session combines several of them: surface expansion to find unknowns, pivoting to map what’s related, and corpus analysis to find structure in what’s been collected,” explained Ryan Fetterman, security researcher at Cisco Talos.
Talos has been running CAIRN against malware development going back to July 2025, when CERT-UA first reported LAMEHUG in the wild, the earliest known sample of AI-integrated malware.
The researchers also found evidence that AI-specific evasion tricks are spreading between attackers. One technique, text embedded to suppress an AI sandbox’s analysis, was traced back to a named red team instructor and then turned up in unrelated malware samples within 12 months of its first confirmed use in the wild.
Malware with four AI models calling the shots
The first result Talos is sharing from CAIRN is a Windows implant named CLOSEDQUORUM, and according to the researchers, it is unlike anything documented before it.
CLOSEDQUORUM architecture (Source: Cisco Talos)
“CLOSEDQUORUM is, to our knowledge, the first publicly documented Windows implant to apply this model to tactical command and control (C2). After deployment, it delegates the selection of its next action to a panel of commercial large language models (LLMs) and executes the resulting decision, with the intent of harvesting user credentials and crypto wallets,” wrote Fetterman.
“It does not require continued commands from a human operator or tasking from a dedicated, attacker-operated C2 server; the complete dynamic operation is delegated to the AI,” he added.
Ordinary malware needs a command-and-control server somewhere, a domain or an IP address the operator controls. Defenders hunt these down, block them, and add them to threat feeds. CLOSEDQUORUM does away with that piece of infrastructure. If two options tie, the malware favors DeepSeek first, followed by Qwen, Mistral, and Gemini, in that order.
The malware queries each provider in turn and asks them to choose the next step from a fixed menu: steal data, inject code, or set up persistence on the machine. Each model returns a vote, and whichever choice gets the most votes wins. If two options tie, the malware always favors DeepSeek first, then Qwen, then Mistral, then Gemini.
Talos researchers found the malware is written in Go and weighs in at 16.4MB. Their static analysis confirmed the whole decision loop works as designed, though the copy they examined shipped with placeholder API keys and a dummy webhook address, so they never watched it run start to finish against a live target.
“CLOSEDQUORUM is an early and limited example, but it makes an emerging threat model concrete and gives defenders an outline of the observable signals they can begin addressing today. As effort displacement expands across more phases of an intrusion, its effects will compound with the speed and scale already afforded by modern AI,” Fetterman wrote.
“The advantage for defenders is that this progression is still only beginning. We have an open window to study this transition, with the aim of developing the detections, controls, and response strategies needed before autonomous operations become more capable and widespread,” he concluded.