Cisco Talos identified CLOSEDQUORUM, a Windows malware sample that polls DeepSeek, Qwen, Mistral, and Gemini to decide whether to steal credentials, inject into a process, or establish persistence no attacker command required. Here is what it does, what defenders should watch for, and what it means for the AI attack classification we track at Digital Warfare.