Breaking

Cisco Talos Finds CLOSEDQUORUM, AI-Guided Malware Using Four LLMs for Command Decisions

September 22, 2026 at 06:04 EDT

Security
AI Agents

Cisco Talos researchers have developed Cognitive Artifact Intelligence Research Network, or CAIRN, a framework for tracking malware and hacking tools that integrate large language models into their operations. The system surfaced CLOSEDQUORUM, Windows malware that polls DeepSeek, Qwen, Mistral, and Google Gemini to decide its next actions without a human command channel.

Sept. 22, 2026 · Cisco Talos

Malware starts asking AI what to do next

CAIRN tracks artifacts left by AI-integrated malware. Its standout find, CLOSEDQUORUM, polls multiple LLMs to choose actions without a normal human command loop.

LLM services polled by CLOSEDQUORUM

Named AI-malware families first found publicly

Additional examples surfaced with CAIRN

CAIRN expands the visible sample set

Earlier named examples

Additional examples

The visible landscape remains small, but the tracker suggests more variety than public reporting had captured.

How CLOSEDQUORUM makes decisions

Step 1Inspect host state

→

Step 2Poll cloud LLMs

→

Step 3Act on consensus

Why defenders care

Prompt patterns and AI API traffic can become early detection signals before the tactic becomes common.

What is still unclear

Attribution and confirmed compromise history remain limited, and many examples still look experimental.

Continue reading

The rest of this article is for AI News Blitz readers. Choose an option below to keep reading.