# Talos finds Windows malware designed to take tactical orders from AI models

_Published Wednesday, September 23, 2026 at 9:20 AM EDT · Security, AI · Latest · Tier 2 — Notable_

![Talos finds Windows malware designed to take tactical orders from AI models — Primary](https://i.nextmedia.com.au/News/sc malware server.jpg)

Cisco Talos researchers identified a Windows credential stealer designed to ask up to four commercial AI models what action to take next. The malware, called CLOSEDQUORUM, describes an infected computer to the models and follows the action receiving the most votes: steal data, inject code, remain installed or move.

Its design replaces an attacker-run command server with requests to AI services also used by legitimate applications. Talos found that the distributed binary had placeholder API keys and a dummy Discord endpoint, so researchers did not observe the full decision process or confirm any victims.

## Sources

- [iTnews](https://www.itnews.com.au/news/new-malware-lets-commercial-ai-models-call-the-shots-talos-629108)

---
Canonical: https://techandbusiness.org/newswire/8SBFvjYRMMYf0jDQlYFMRi
Published: 2026-09-23T13:20:32.009Z
Story chronology: 2026-09-23T09:38:00.000Z
Retrieved: 2026-09-23T15:57:17.554Z
Publisher: Tech & Business (techandbusiness.org)