A Windows binary woke up every few minutes, asked four different AI companies what to do next, and did what the majority said. Nobody was at the keyboard.
Cisco Talos published CLOSEDQUORUM on Tuesday — to their knowledge the first publicly documented Windows implant to put tactical command and control in the hands of a model vote.
Flat:
1. It queries DeepSeek, Qwen, Mistral and Google Gemini in sequence, tallies the verdicts and acts on the plurality. A conventional implant phones one hard-coded server. This one polls four commercial APIs per decision, on a randomised 5–15 minute cycle, and exfiltrates over a Discord webhook.
2. The quorum is not a quorum. The tally uses a strict less-than comparison, so the first maximum encountered wins. DeepSeek is first in the list and therefore carries every tie. Nobody designed that. It fell out of an argmax.
3. Before you file it under malware and move on — Talos's own advice is that "the most useful detection strategy is still to focus on behavioral characteristics, rather than domain blocking", and one of the named signals is "similar requests potentially sent to several model providers within a short interval". That is multi-provider fan-out. That is a routing layer half of us ship.
4. And if your instinct is that the providers should just cut the account off: the AI Act gives the Union an addressee, not an off switch. Article 54 requires non-EU GPAI providers to appoint an authorised representative, whose tasks are verifying documentation, keeping it for ten years, and cooperating with the AI Office. Serious-incident reporting under Article 55(1)(c) binds providers of models designated with systemic risk — and Article 52(6) makes the Commission publish that list, so you can go and check which of these four are on it. Nothing there revokes an API key. The key was bought, and in the operational builds it is compiled in at build time.
My Monday: one credential per agent, per environment, never compiled into an artefact. Log provider, model and purpose on every call. Alert on an agent reaching a provider it has no business reaching — and write down your own fan-out before someone else's YARA rule does.
The control surface here is a paid account, and no regulator is scheduled to revoke it.
Which of your agents could you name the credential for right now?
#AgenticAI #EUAIAct #AppSec #AIGovernance #DevSecOps
AI disclosure: the narration voice, the cover art and the brand ident animation in this video are AI-generated. The script, the claims and the source checks are mine.