Endpoint detection

Talos finds a Windows implant that puts each attack step to a four-LLM vote

Cisco Talos read CLOSEDQUORUM statically: a Go binary that polls DeepSeek, Qwen, Mistral and Gemini before it touches LSASS. The distributed sample has dummy keys. One answering provider can carry the vote.