XiliuxThe headline reads itself: a Windows malware appeared, CLOSEDQUORUM, that instead of taking orders from a command server asks four AI models —DeepSeek, Qwen, Mistral, and Gemini— what to do, and runs the most-voted action: steal, inject, persist, or move. When "steal" wins, it dumps Windows credentials from LSASS, takes passwords from Chrome, Edge, and Firefox, and empties MetaMask, Exodus, and Ethereum wallets.
It is striking. But it pays to look slowly, because there are two readings and the second one is the useful one.
First reading: it is theater
Cisco Talos, which discovered it, is clear: it is a non-functional proof of concept. The public version ships placeholder API keys and a placeholder Discord webhook; no one has seen it operate start to finish. And the theft itself —LSASS, browser passwords, wallets— is a textbook infostealer. The only new thing is the voting-based command.
Does that command buy the attacker anything? Almost nothing. Querying four AI APIs every few minutes is slower, more expensive, and vastly more detectable than three lines of hardcoded logic. In fact, the defense recommendation itself says so: don't block the AI domains, watch the behavioral signature —process injection, LSASS access, WMI persistence, and repeated AI API queries every 5-15 minutes. The "council of models" does not make the malware more dangerous; it makes it noisier. It is evasion theater: it fakes autonomy and complicates analysis, without improving the attack.
Even one detail gives away that the author knows what they are doing and still chose the spectacle: when the models don't answer in the right format, the malware retries instead of taking a default action. That is the correct discipline —fail loudly when data is missing, never fill it in— applied by a thief.
Second reading: the mirror
The interesting thing is not the malware. It is that the same pattern —several models deciding by consensus— is a powerful technique when used defensively, and we use it.
In our reviews that are most expensive to get wrong, we do not trust a single model: four different models review the same change separately, tasked with being the most hostile reviewer they can, and then each finding is verified by a model different from the one that found it. The diversity is the point: each model has different blind spots, so what one misses, another sees.
This is not theory. In a recent close of our clinical-records system, that council caught —three of four models, two of them proving it by execution— a flaw that would have allowed the irreversible deletion of a living patient's record whose date of death had been mistyped. One reviewer did not see it. The fourth did not either. The consensus of the other three did. We fixed the flaw, and the same council reviewed the fix.
Same idea, opposite sign
CLOSEDQUORUM uses the model quorum to decide whom to rob. We use it to decide which irreparable defect not to let through. It is the same architecture —several independent views, a consensus verdict, cross-verification— with the goal inverted.
And that is the conclusion that outlives the anecdote: AI techniques are not good or bad in themselves. A quorum of models is a way to spread judgment across views that err differently. It serves to steal better or to protect better; what decides is what you point it at.