Cisco Talos reports discovery of CLOSEDQUORUM Windows malware using AI models for autonomous actions
Cisco Talos, the cybersecurity research division of Cisco, has announced the discovery of a novel Windows malware identified as "CLOSEDQUORUM." This sophisticated threat is reported to leverage commercial artificial intelligence models to autonomously guide its post-compromise activities, thereby eliminating the need for human intervention in certain attack phases. The initial detailed report originated from a first-party blog post by Cisco Talos, which subsequently informed the extensive media coverage.The CLOSEDQUORUM malware reportedly employs a "hive mind" strategy, querying a panel of AI models, including Google Gemini, DeepSeek, Qwen, and Mistral, to collectively determine its next operational steps. These autonomous decisions encompass critical functions such as command and control (C2) and credential theft. In response to this new class of threat, Cisco Talos has released an open-source detection tool named CAIRN, designed to identify AI-integrated malware without requiring direct binary analysis. While the capabilities are detailed by Cisco, the broader media largely reiterates these claims without independent verification of the malware's prevalence or real-world impact.
15 articles from 15 outlets covered this story. No difference in framing or figures was found between them. The underlying claim is sourced from a press release.
What do all outlets agree on?
15 outlets covered “Cisco Talos reports discovery of CLOSEDQUORUM Windows malware using AI models for…”. All of them report the following:
- Cisco Talos discovered new malware
- The malware is named CLOSEDQUORUM
- It targets Windows systems
- It uses commercial AI models for autonomous decision-making
- AI models guide post-compromise actions
- Specific AI models mentioned include Gemini, DeepSeek, Qwen, and Mistral
- The malware performs command and control (C2) and credential theft
- Cisco Talos open-sourced a detection tool called CAIRN
- CAIRN helps detect AI-integrated malware
Did outlets disagree about this?
No. All 15 outlets covering “Cisco Talos reports discovery of CLOSEDQUORUM Windows malware using AI models for…” reported it the same way — no difference in framing or figures was found between them.
Which outlets covered this?
All 15 articles found on this story, grouped by the stance of the piece. Every link goes to the original publisher.