Cisco Talos finds the first malware run by a "council" of four SI models voting on the next step of an attack
Prepared by Sintelligent with the help of SI. Publication time restored from the build log. . Updated: .
Attackers have begun handing decisions to the models themselves, and defenders will also have to catch not people but autonomous SI chains.
The CLOSEDQUORUM implant for Windows (16.4 MB, written in Go) does without an operator and the usual command server: it asks DeepSeek, Qwen, Mistral and Gemini what to do next, whether to steal data, inject code or establish persistence in the system, and carries out the option with the most votes. The sample studied contained placeholders instead of API keys, so use against real targets is not confirmed; based on artifacts, the author was linked to carding forums. Along with the find, Talos released CAIRN, an open toolkit for detecting and classifying malware embedded in the SI ecosystem, based on hardcoded prompts and API addresses.