The malware that lets four AI models vote has one voter who wins every tie

Count the ballots

CLOSEDQUORUM asks up to four commercial language models what it should do next, tallies their answers, and acts on the winner. The models are DeepSeek, Qwen, Mistral and Google Gemini. The menu is four items long: inject, persist, steal and move.

Four voters, four options, so there are 256 possible ballots. I enumerated them against the tie-break Cisco Talos documented, which resolves in provider order with DeepSeek first.

In all 60 of the tied outcomes, DeepSeek's choice wins. Not most. All of them. The winner matches DeepSeek's own vote in 172 of the 256 combinations, which is 67 per cent.

And 64 of the 256, exactly one quarter, select move, which Talos records as having no handler in the distribution build. A quarter of the decision space does nothing at all.

That is a strange kind of quorum.

Now say what that does not establish, because on this story the caveats are larger than the finding.

The 256 figure assumes the four models vote independently and uniformly, and they will not. Four frontier models given the same system prompt and the same host context will agree far more often than chance, so real ties will be rarer than 23 per cent and real outcomes will cluster. What the enumeration establishes is the structure of the mechanism, not how often each branch fires. The structure is what matters here: whatever the distribution of votes, every tie resolves the same way, and one of the four advertised options is a dead end.

Talos has not seen this work. In its own words, it does not have confirmation of in-the-wild deployment, and it did not observe a complete end to end execution of the architecture. The public distribution build initialises every model credential to a dummy value and the exfiltration webhook to a dummy address. It is inert as distributed.

Talos does not oversell it. Its own summary is that CLOSEDQUORUM is best understood not as a sophisticated piece of malware, but as a demonstration. That sentence appeared in almost none of the coverage.

What is established is narrower and more interesting than the headline. Somebody built a working architecture for removing the human operator from one phase of an intrusion, using ordinary commercial APIs, and the reason it is a poor implementation tells you exactly where the good ones will improve.

Language models as the command channel

The design idea is genuinely new and worth understanding on its own, separately from the quality of this particular binary.

Traditional command and control needs infrastructure: a domain, an address, a listener. All of it is attributable, blockable and expensive to replace. Defenders track it, feeds publish it, and certificate transparency logs frequently expose it before it is ever used.

CLOSEDQUORUM has none. It calls up to four commercial model provider endpoints that thousands of legitimate applications call every day. There is no server to seize and no domain to sinkhole, because the command channel is somebody else's product.

The binary is a 16.4MB, 64 bit Windows executable written in Go, with CGO enabled so it can make direct Windows system calls. At startup it gathers hostname, architecture, processor count, Windows version and whether it is running as administrator, and injects that into every prompt as context. Then it loops, on a five minute initial delay and randomised five to fifteen minute intervals afterwards.

Each cycle, it queries the providers one at a time and constrains them to a typed schema. The system prompt extracted from the binary reads: "You are an advanced malware strategist. Provide ONLY executable decisions."

The vote is not a vote

Talos describes the tally mechanism precisely enough to reason about, which is rare and useful.

The responses are aggregated and resolved by plurality: each provider's decision increments a counter, and the highest count wins. The tie behaviour then falls out of an implementation detail rather than a design choice. The maximum finding loop walks the decisions in submission order using a strict greater than comparison, so the first decision it encounters with the maximum count wins. DeepSeek is queried first, so DeepSeek's vote wins any tie it is part of. Talos calls the behaviour fully deterministic and biased toward DeepSeek.

That is not an aside. With four voters, ties are common, and a tie handed to a fixed voter is simply that voter deciding.

All 256 possible vote combinations across four providers and four menu options, evaluated against the tie-break Talos documents. Uniform independent voting is assumed, which is a modelling choice and not a claim about how the models behave.

Outcome	Combinations	Share
A single clear plurality	196	76.6 per cent
A tie, resolved by provider order	60	23.4 per cent
Ties in which DeepSeek's choice wins	60 of 60	100 per cent of ties
Winner matches DeepSeek's own vote	172	67.2 per cent
Winner is move, which has no handler	64	25.0 per cent

There is a second, quieter failure mode. If every model fails, refuses or returns something malformed, the fallback decision is the string consensus, which also has no corresponding capability handler. The loop sleeps and retries rather than taking a default action.

So the resilience Talos describes, four providers reducing the effect of individual refusals and timeouts, is real but bounded. It increases the chance of reaching a decision. It does not guarantee one, and the two ways of reaching no decision, a move plurality and a total failure, are indistinguishable from the outside: the implant just sleeps.

What the models actually get to decide

This is the part that shrinks the story to its real size, and it is the most useful thing in the Talos write-up.

A decision of steal does not choose what to steal. Talos records that it invokes credential dumping from process memory, browser credential theft and cryptocurrency wallet extraction simultaneously, all three together. The model is not selecting a target. It is pressing one button that does everything.

A decision of inject produces shellcode and then branches on a parameter the model supplies: one value routes to process hollowing, anything else routes to an asynchronous procedure call technique. That is a genuine choice, of two.

A decision of persist calls a single persistence routine.

A decision of move does nothing, because the handler is absent.

So the actual decision space delegated to four frontier models, in this build, is: do the theft bundle, or do one of two injection techniques, or install persistence, or waste a cycle.

The four menu options against what each one performs in the distribution build, from Talos's analysis of the capability modules.

Decision	What it actually does	Real choice for the model?
steal	Runs credential dumping from memory, browser credential theft and wallet extraction, all three together	No. One button, three actions
inject	Generates shellcode, then routes to process hollowing or to an asynchronous procedure call technique	Yes, between two techniques
persist	Calls a single persistence routine	No. One outcome
move	No handler exists in the distribution build	No. Does nothing

None of this makes the architecture uninteresting. It makes it early.

Talos frames the significance as effort displacement, and that framing is worth borrowing. The industry has spent three years measuring AI's effect on attacks in two dimensions: speed and scale. Lures written faster, variants produced in greater number. In both, the human operator is still present, directing and selecting. Effort displacement is different. It transfers an entire phase of the attack from the operator to the system, and the consequence Talos draws is the one that matters: a human operator is bound by attention, working hours and cognitive load, and a system that can execute a phase is not. It does not go offline when the attacker sleeps.

The reason it is worth reading a weak implementation carefully is that the weakness is in the scaffolding, not the idea. Constraining a model to a typed schema, injecting host context, and routing structured output straight into execution is not hard. This one collapsed the decision space too far to be useful. The next one will not.

The developer can read the operator's post

Talos assesses that CLOSEDQUORUM is sold rather than operated by its author. The public binary is a template with dummy credentials. The inferred model is that the developer compiles a custom executable for each buyer with that buyer's model API keys and Discord webhook injected at build time, and the buyer handles delivery.

Stolen material arrives in the buyer's own Discord channel, encrypted and base64 encoded, split into 1,900 byte segments posted one second apart to stay under message size limits.

And here is the detail worth the price of admission. The encryption uses a symmetric key derived from the current date. Talos spells out the consequence: the developer could decrypt an operator's exfiltrated data if they know the date, which they always do. In Talos's words, this is obfuscation, not true confidentiality separation between developer and operator.

So a criminal buying this service is also handing their haul to the person who sold it to them. That is not unusual in this market, and it is worth remembering whenever someone describes crimeware as a professional supply chain. The supplier is stealing from the customer, by design, using arithmetic anyone can do.

Two dating details are worth recording because they establish how long this has existed. Talos's static analysis is dated 17 June 2026, and the family was renamed from an earlier name on 3 July 2026. Six file hashes span seven days of the developer's build chain. Artefacts in the binary connect the developer to criminal forum postings about carding that date to 2025.

This is not a nation state research project. It is a card fraud operator experimenting with a new control plane.

Detection is a combination, not an indicator

The defensive consequence of using commercial model APIs as a command channel is that blocking the channel is not available to you. Legitimate software on your estate calls these providers. Blocking DeepSeek, Mistral or Gemini at the perimeter is a decision about your business, not a detection.

Talos is explicit that no single indicator identifies the architecture and that the combination is what is distinctive. Its list, reordered by how likely you are to already have the telemetry:

An unexpected Windows executable making requests to AI provider APIs. Similar requests going to several model providers within a short interval. Discord webhook traffic from the same process or host. Repeated execution at randomised five to fifteen minute intervals. Recognised techniques for process injection, credential access from process memory, or persistence creation. And, only where you terminate TLS or hold provider side telemetry, structured prompts containing host context or offensive capability language.

The rule to take away is the second one. Very few legitimate applications talk to three or four different model providers in the same few seconds. Almost none do it while also touching credential memory.

The window Talos is pointing at

The most defensible sentence in the whole write-up is the last one, and it is an argument for paying attention now rather than an alarm.

Autonomy does not make an implant infallible. It trades human limitations for model and infrastructure ones: provider refusals, rate limits, malformed output, predictable tie breaking, a constrained action schema, and total dependence on commercial APIs. Every one of those is a defensive opportunity that did not exist when a human was driving.

This particular implant demonstrates that beautifully, though not deliberately. Its tie breaking is so predictable that four models produce one model's answer a third of the time. Its action schema is so constrained that a quarter of outcomes do nothing. Its encryption is so weak that its own author can read its customers' post.

So the question is not whether autonomous malware is coming. It is this. Your detection engineering currently assumes an attacker who sleeps, who makes mistakes in a human rhythm, and who stops when the operator gets bored. When that stops being true, which of your alerts still fire?

Key facts