Cisco Talos has disclosed ClosedQuorum, an AI-powered Windows 11 malware written in Go that invokes AI models such as Google Gemini, DeepSeek, Qwen and Mistral to autonomously decide attack actions after infection, including stealing browser credentials, extracting cryptocurrency data, maintaining persistence and spreading laterally. Talos says it is the first publicly documented Windows implant to delegate tactical C2 decisions to a group of AI models.