Cybersecurity researchers have uncovered a new Windows malware strain that leverages multiple artificial intelligence models to guide its own actions during an attack. Named CLOSEDQUORUM by researchers at Cisco Talos, the malware represents a significant evolution in how cybercriminals may incorporate AI into malicious software.
How CLOSEDQUORUM Works
Unlike traditional malware, which follows a fixed set of instructions from its developers, CLOSEDQUORUM can communicate with up to four AI systems: Google Gemini, DeepSeek, Qwen, and Mistral. Researchers describe this arrangement as a kind of “hive mind,” where the malware can seek input from multiple models rather than depending on a single AI service.
If one AI service becomes unavailable, the others can continue to provide responses, allowing the malware to keep operating without a human operator selecting its next action. According to Cisco Talos, CLOSEDQUORUM can choose from a predefined set of activities, including stealing login credentials and cryptocurrency-related information. However, researchers have not yet identified the malware’s creator or confirmed that it has been used in real-world attacks.
A Growing Category of AI-Integrated Malware
Cisco Talos has established the Cognitive Artifact Intelligence Research Network (CAIRN) to identify and study malware that incorporates AI. The researchers say AI-enabled programs often leave behind identifiable traces that can help security teams distinguish them from conventional malware.
When Cisco Talos first searched for AI-powered malware, they found roughly nine named families and several proof-of-concept samples. After developing CAIRN, the team identified about 20 additional examples within a few months, suggesting this technique is quickly becoming more common.
AI Moves Beyond a Tool for Attackers
The discovery of CLOSEDQUORUM points to a shift in how AI is being used in cybercrime. Previously, discussions focused on attackers using AI to generate phishing emails, write malicious code, or automate tasks. Now, AI is being embedded directly into malware itself, providing real-time guidance during an operation.
Cisco Talos researcher Matt Olney said attackers are beginning to “operationalize” AI, potentially allowing malicious campaigns to adapt to different systems and expand their reach. For security teams, this means monitoring AI-related indicators will likely become an increasingly important part of malware detection and analysis.
