When Malware Asks AI Models What to Do Next

On September 22, Cisco Talos published its analysis of CLOSEDQUORUM, a Windows implant designed to ask commercial AI models to select its next action. The timely security question is how defenders recognize malicious activity when its decision-making depends on services their organizations also use legitimately.

Talos describes a voting mechanism across up to four model providers, with decisions mapped to implemented capabilities such as credential theft, process injection, and persistence. The evidence has important limits: researchers confirmed the decision loop through static analysis, but the public distribution build contained placeholder credentials and a dummy webhook. They did not observe complete end-to-end execution and have not confirmed deployment in the wild.

The same day, Talos released CAIRN, a research toolkit that searches sample metadata for signs of AI integration. It combines rules, similarity analysis, and relationship graphs to help analysts find candidates without downloading or executing binaries. Its classification separates basic AI artifacts from behavioral context and confirmed family fingerprints. Talos cautions that bundled libraries can generate misleading matches, and that similarity clusters need individual investigation. The accompanying CAIRN and CLOSEDQUORUM reports are primary sources from the same research team, rather than independent corroboration.

For detection, Talos emphasizes the combination of unusual AI-provider connections and endpoint activity such as credential access or process injection. A familiar provider domain alone cannot establish whether the calling process is trustworthy. The operational implication is to preserve the link between network events and the executable responsible for them.

HackWednesday’s recommended exercise this week is to select one endpoint group and check whether analysts can identify which processes contact approved model services. Document telemetry gaps, assign an owner, and test the investigation workflow with benign activity. Keep candidate AI-related matches separate from confirmed malicious behavior in reports. The useful outcome is an investigation path that joins process identity, network access, and security events, with confidence stated explicitly.