This Windows Malware is Built to Let Up to Four AI Models Vote on Its Next Move

Summary

Cisco Talos reported on September 22 a Windows malware named CLOSEDQUORUM that asks up to four commercial AI services (DeepSeek, Qwen, Mistral, and Google Gemini) to vote on its next action instead of taking orders from an attacker's C2 server. The chosen action can be steal, inject, persist, or move, and Talos said the public version's move action has no code and the public build cannot reach the models because it has placeholder API keys and webhook values.

Related items

• Infollm-gemini 0.37Same vendor · Simon Willison's Weblog
• InfoGoogle’s new Gemini model is better at understanding complicated questionsSame vendor · The Verge (AI)
• InfoNo, AI agents did not discover a previously unknown Maya siteSame vendor · The Verge (AI)
• LowAI chatbots are recommending fake retail websites, study findsSame vendor · The Verge (AI)
• InfoJim Cramer: This is the bet you're making if you buy the Anthropic IPOSame vendor · CNBC Technology