CLOSEDQUORUM puts its next action to a vote of four commercial LLM providers
Cisco Talos found a 16.4MB Go implant that asks DeepSeek, Qwen, Mistral and Gemini what to do next and acts on the winning vote, treating the providers themselves as its C2 infrastructure. Talos has no confirmation it was ever deployed.
The Watch · Security desk
What happened
- Cisco Talos published CLOSEDQUORUM, a Windows malware binary found through its CAIRN project, which it says exhibits fully autonomous command and control.
- The implant's decision panel is up to four commercial LLM providers, DeepSeek, Qwen, Mistral and Google Gemini, queried in sequence with no human admitted to the session.
- After deployment it delegates the choice of its next action to those models and executes the result, aiming to harvest user credentials and crypto wallets.
- Talos says the binary runs without continuing commands from a human operator or tasking from a dedicated attacker-operated C2 server.
Why it matters
- What's now possible capability A phase of the intrusion can keep progressing unattended, so an operator's working hours and attention stop bounding how far it gets overnight.
- What it limits constraint Domain blocking, takedown requests and C2 feed tracking lose their hold when the tasking channel is a commercial API the enterprise already allows outbound.
- Who's exposed exposure Approved LLM API traffic and the strings baked into binaries become the inspection surface. Most detection teams are not doing that work.
- What doesn't add up contradiction Talos calls this the first autonomous AI C2 implant on the strength of static analysis, while stating the loop was never seen running, so the capability claim runs ahead of what was observed.
Next story · Leadership · yesterday
Apple Intelligence clears China's regulators without Siri AI and with government sign-off on updatesConfirmed4 publishers
Four models are queried in sequence, their independent verdicts tallied, and the action with the most votes is executed [6]. A plurality carries it, and the panel is up to four providers [5]. With four active voters and no majority threshold, an action can win on two votes; with one provider's key compiled in, a single model's output decides [23]. Talos found that development builds inject provider credentials at build time, so the number of voters is set by whoever compiles the binary [7].
The C2 design is the part that changes defensive work. Talos describes conventional C2 as attacker-run infrastructure, a domain, an IP, a protocol and a listener, all of it attributable, blockable and expensive to rotate [11]. CLOSEDQUORUM instead treats the LLM providers as the C2 infrastructure [10], so the implant's outbound tasking traffic goes to DeepSeek, Qwen, Mistral and Google Gemini [5]. Those are services many enterprises already permit.
The framing Talos uses separates this from the AI-offense reporting of the past few years. Speed and scale left the operator in place. The human still directed the tooling, selected targets and guided execution [14]. Effort displacement moves an entire phase off the operator and onto the system, so attention, working hours and cognitive load stop setting the pace [15]. "It does not go offline when the attacker sleeps," Talos wrote of a system able to execute a phase of the attack chain [16].
The hunting method published with the finding runs on metadata alone, without downloading or executing the binary, and applies up to 24 acquisition filters across extracted strings, sandbox behaviour and antivirus detection labels [19][20]. The filters look for LLM provider endpoints, local inference runtimes such as ollama and llama.cpp, and tool-call syntax co-occurring with offensive capability terms [21]. Talos argues attackers building AI-integrated malware inevitably leave these markers behind, including prompt templates, API keys and jailbreak terms [22].
What is on the record is static analysis of a distribution build carrying placeholder API keys and a dummy webhook [8]. Talos says it did not observe a complete end-to-end execution of the architecture, and has no confirmation of in-the-wild deployment [8][2]. The only date attached to the actor is 2025, when binary artifacts link the developer to carding-related postings on criminal forums [12]. There is nothing here to patch this week, though the design is already compiled into a 16.4MB Go executable by someone posting on carding forums, and Talos says CLOSEDQUORUM is the first of a series of findings from its CAIRN toolkit [13][12][17].
What to watch
- A sample with live provider credentials, or a named victim, would move this from static analysis to an incident.
- Whether DeepSeek, Qwen, Mistral or Google restrict or flag API accounts used as implant tasking channels.
- The next CAIRN posts: whether any finding turns out to be an active campaign, or another build with dead keys.
Clarity's read
What the record supports and how the coverage leans. The claims behind it follow.
Reality
- Evidence58
- Adoption
- Not scored
- Hype gap+30
- Incentives45
- Confidence62
Perspective Coverage
7 publishers- Builder
- Builder 28%
- Operator
- Operator 66%
- Investor
- Investor 6%
Claim ledger
Ranked by verification strength, evidence, and original report placement.
- [1]
CLOSEDQUORUM, a malware binary discovered through Cisco Talos' CAIRN project, exhibits fully autonomous command and control.
- [2]
Talos says it does not have confirmation of in-the-wild deployment of CLOSEDQUORUM.
- [3]
After deployment, CLOSEDQUORUM delegates the selection of its next action to a panel of commercial large language models and executes the resulting decision, with the intent of harvesting user credentials and crypto wallets.
- [4]
CLOSEDQUORUM does not require continued commands from a human operator or tasking from a dedicated, attacker-operated C2 server; the complete dynamic operation is delegated to the AI.
- [5]
CLOSEDQUORUM's quorum is up to four LLM providers: DeepSeek, Qwen, Mistral and Google Gemini. The session is closed; no humans are admitted.
- [6]
Four models are queried in sequence, their independent verdicts tallied, and the binary acts based on their judgment; each active model votes on the next action and the action receiving the most votes is selected.
- [7]
Talos' static analysis confirms the full details of the autonomous decision loop, and development builds demonstrate build-time injection of provider credentials.
- [8]
The public distribution build contains placeholder API keys and a dummy webhook, so Talos did not observe a complete end-to-end execution of the architecture.
- [9]
CLOSEDQUORUM is, to Talos' knowledge, the first publicly documented Windows implant to apply this model to tactical command and control.
- [10]
The foundational design choice in CLOSEDQUORUM is the treatment of LLM providers as the C2 infrastructure.
- [11]
Traditional C2 architecture requires the attacker to operate server infrastructure: a domain, an IP, a protocol and a listener. That infrastructure is attributable, blockable and expensive to rotate, and defenders track C2 domains.
- [12]
Artifacts from the binary were used to connect the developer to postings on criminal forums related to carding, dating back to 2025.
- [13]
CLOSEDQUORUM is a 16.4MB, 64-bit Windows executable compiled in Go.
- [14]
AI's impact on offensive cyber operations has so far focused on speed and scale, and in each case the human operator remains present, directing the tooling, selecting targets and guiding the execution.
- [15]
Effort displacement transfers an entire phase of the attack from the operator to the system and compounds the effects of speed and scale because the human-in-the-loop is no longer the bottleneck; human operators are bound by attention, working hours and cognitive load.
- [16]
"It does not go offline when the attacker sleeps."
- [17]
Cisco Talos released CAIRN, an open-source research toolkit for hunting, classifying and tracking AI-integrated malware, and says CLOSEDQUORUM is the first in a series of posts sharing its findings.
- [18]
CAIRN stands for Cognitive Artifact Intelligence Research Network.
- [19]
CAIRN operates entirely from metadata, with no binary downloads or execution required.
- [20]
CAIRN discovers candidate samples through up to 24 acquisition filters, each targeting a different type of AI-related artifact, searching metadata including extracted strings, sandbox behavior and antivirus detection labels.
- [21]
CAIRN filters search for LLM provider endpoint strings such as api.openai.com, api.anthropic.com and api.deepseek.com, local model inference strings including ollama, llama.cpp, vllm, gguf and safetensors, and tool-call syntax (tool_call, tool_calls, function_call) co-occurring with offensive capability terms.
- [22]
Talos says attackers building AI-integrated malware unintentionally and inevitably leave behind markers of their own: prompt templates, provider endpoints, API keys, jailbreak terms and other artifacts embedded throughout their tooling.
- [23]
Because the selected action is the one with the most votes among up to four active models, an action can be chosen on two of four votes, and a build carrying only one working provider credential decides on a single model's output with no vote able to contest it.
- [24]
Talos says CLOSEDQUORUM represents a shift in effort displacement for attackers, in which expanding portions of the attack chain can be executed without operator involvement.
Sources
7 independent publishers whose own reporting we read for this story.
- bleepingcomputer.comNew ClosedQuorum Windows malware uses AI for attack decisions
2 articles · September 22, 2026
- blog.talosintelligence.comIntroducing CAIRN: Frontier tracking for AI-integrated malware
4 articles · September 22, 2026
- helpnetsecurity.comResearchers uncover malware that uses AI to choose its next move
2 articles · September 22, 2026
- itnews.com.auNew malware lets commercial AI models call the shots: Talos - iTnews
1 article · September 22, 2026
- scworld.comFirst ‘autonomous AI C2 implant’ uses panel of models to vote on next task
1 article · September 23, 2026
- securityaffairs.comCLOSEDQUORUM, the malware that asks four AI models what to do next
1 article · September 23, 2026
- thehackernews.comThis Windows Malware is Built to Let Up to Four AI Models Vote on Its Next Move
2 articles · September 24, 2026
Topics and entities
Topics
- Command and Control
- AI-integrated malware
- Threat hunting