This Windows Malware is Built to Let Up to Four AI Models Vote on Its Next Move

Malware that asks four LLMs what to do next, then goes with the majority vote. Cisco Talos found CLOSEDQUORUM sending host name, Windows version and admin status to DeepSeek, Qwen, Mistral and Gemini, then running whichever action wins: steal, inject or persist. The public sample has placeholder API keys, so it’s a prototype, not a crisis. Still, a random binary talking to four AI providers is now a detection signal worth having.