Cisco Talos found a 16.4MB Go implant that asks DeepSeek, Qwen, Mistral and Gemini what to do next and acts on the winning vote, treating the providers themselves as its C2 infrastructure. Talos has no confirmation it was ever deployed.
Perspective Coverage
7 publishers
- Builder
- Builder 28%
- Operator
- Operator 66%
- Investor
- Investor 6%
Reality
- Evidence58
- Adoption
- Not scored
- Hype gap+30
- Incentives45
- Confidence62
Cisco Talos finds malware that hands its command-and-control decisions to four voting models
Cisco Talos says its CLOSEDQUORUM sample asks four language models for executable decisions, tallies the votes and acts on the winner. An entire phase of the attack runs while the operator is offline.
Reality
- Evidence50
- Adoption8
- Hype gap+40
- Incentives62
- Confidence54
Talos details a credential stealer that asks four commercial model APIs what to do next
Cisco Talos has published CLOSEDQUORUM, a Windows credential stealer with no command-and-control server. It hands the state of the infected host to Gemini, DeepSeek, Qwen and Mistral, then acts on the majority verdict.
Reality
- Evidence52
- Adoption15
- Hype gap+18
- Incentives68
- Confidence55
buildOne report1 publisher A tie in CLOSEDQUORUM's four-model vote hands the decision to DeepSeek
Cisco Talos released its CAIRN framework on September 22nd to hunt prompts, provider endpoints and API-key prefixes in malware metadata. Its first case study polls four commercial models and runs the winner.
Reality
- Evidence58
- Adoption18
- Hype gap+10
- Incentives60
- Confidence55
Cisco Talos's new malware tagger roughly tripled the public tally of AI-integrated samples
Cisco Talos has open-sourced CAIRN, a framework that tags malware by the traces its AI calls leave in metadata. The first sample it surfaced polls DeepSeek, Qwen, Mistral and Gemini for orders and decides for itself.
Reality
- Evidence55
- Adoption18
- Hype gap+26
- Incentives62
- Confidence58