Cisco Systems Inc.’s Talos Threat Intelligence group today released an open-source toolkit for hunting malware that has artificial intelligence built into it.
The first sample it has detailed is a Windows credential stealer that takes its orders from no command-and-control server. Talos calls it CLOSEDQUORUM, and its tactical decisions go to a vote among four commercial large language models. No other Windows malware has been publicly documented handing those decisions to a model panel, the researchers wrote.
The four models are Google Gemini, DeepSeek, Qwen and Mistral, and CLOSEDQUORUM queries them in sequence every five to 15 minutes. The 16.4-megabyte Go binary hands each one the state of the host, under a system prompt telling it that it is “an advanced malware strategist” and should return only executable decisions.
Whichever decision draws the most votes wins, and DeepSeek holds the tie-break. The winning call goes to one of four modules that steal credentials, inject code, establish persistence or move laterally.
“The session is closed; no humans are admitted,” Talos researcher Ryan Fetterman wrote in a blog post. “Four models are queried in sequence, their independent verdicts tallied, and the binary acts, based on their judgment.”
The steal module runs three collection routines at once, taking Windows credentials from process memory, saved passwords from Chrome, Edge and Firefox, and wallet files from MetaMask, Exodus and Ethereum keystores. The haul is encrypted and pushed out through Discord webhooks. Persistence comes from registry run keys, scheduled tasks and Windows Management Instrumentation subscriptions. Windows event tracing is suppressed as well.
Nothing yet suggests CLOSEDQUORUM has been used against anyone. Talos has six samples covering about a week of the developer’s build chain, and artifacts inside them tie that developer to criminal forum accounts posting about carding since 2025. The assessment is a credentials-as-a-service operation, with the developer building customized binaries and the buyer handling delivery.
Talos put the toolkit that found it, the Cognitive Artifact Intelligence Research Network, on GitHub. CAIRN works from metadata, so nothing has to be downloaded or detonated. Twenty-four acquisition filters look for what AI integration leaves behind, among them calls to commercial model providers, Python framework imports, local model runtimes and natural-language text planted to derail an automated analyst. YARA rules sort the hits into three tiers, from the bare presence of AI components up to named malware families, and an embedding model groups samples that share no strings at all.
Those filters have been running over samples collected since July 2025. Language models were an optional feature bolted onto a payload when the hunts started. A single calendar year later the models were running the payload, and CLOSEDQUORUM sits at the far end of that arc. The same evasion trick travels. Talos followed it back to a red team instructor, and independent actors’ samples were carrying it within 12 months, crossing from loose scripts into compiled malware along the way.
Fetterman framed the shift as one of effort displacement, with “expanding portions of the attack chain” now running without an operator. Human attackers are bound by “attention, working hours, and cognitive load,” he wrote. The panel answers every five to 15 minutes, indefinitely. Defenders, in his assessment, still have an open window to study the transition before it becomes ordinary.
