2026-09-22 / Signal #1
The malware that takes orders from a four-model hive mind
“The botnet doesn’t have a boss. It has a group chat of models, and the group chat is the boss.”
The Story
Cisco Talos today published CLOSEDQUORUM, which it calls the first documented Windows implant whose command-and-control is a closed vote among commercial models. After infection it queries DeepSeek, Qwen, Mistral, and Google Gemini, tallies their answers, and acts on the plurality—with no human operator in the loop. Talos has not confirmed a live campaign; it tied artifacts to older carding-forum posts and says the payload is built to steal logins and crypto. A companion toolkit, CAIRN, is being open-sourced to hunt this class of AI-integrated malware. render_inline_citationcitation_id65
Why It Matters
Not “AI writes phishing.” Four branded oracles form a private parliament inside a stolen PC, and the winning vote is the next crime. The strange future is majority-rule malware: if Gemini is down, Qwen still votes.
Evidence
Source evidence is in the linked daily scan.
Sources
Daily scan: 2026-09-22