Cisco Talos Reveals ClosedQuorum, First Windows Implant to Delegate C2 Decisions to AI Models

Cisco Talos disclosed a new AI-powered malware family named ClosedQuorum on September 22, 2026. The malware targets Windows 11 systems and is written in Go. After compromising a device, it can call on AI models such as Google Gemini, DeepSeek, Qwen and Mistral to autonomously plan its next actions.

According to Talos, ClosedQuorum can steal browser login credentials, extract cryptocurrency-related information, maintain persistence and move laterally across networks. The malware operates without direct human operator commands, relying on reconnaissance data and a voting system to decide its course of action.

Talos described ClosedQuorum as the first publicly documented Windows implant to delegate tactical command-and-control (C2) decisions to a group of AI models, adding that the approach gives malicious operations greater speed and scalability.