CLOSEDQUORUM: Cisco Talos reveals the first malware with a 100% autonomous, AI-driven C2

CLOSEDQUORUM: Cisco Talos reveals the first fully autonomous AI-driven C2 malware

🔎 The malware that puts its next attack to a vote

On September 22, 2026, Cisco Talos published its analysis of CLOSEDQUORUM, the first fully autonomous command-and-control (C2) implant ever reported. Its distinguishing feature can be summed up in one sentence: after deployment, no human is in the loop. A panel of four commercial large language models decides the malware's next action — and the binary executes it.

This is not an isolated incident; it's the endpoint of a curve. In July 2025, CERT-UA reported LAMEHUG, a malware that used an LLM as an optional feature. Fourteen months later, Talos documents a consensus-based multi-model orchestrator, with no operator and no dedicated control server. The vendor observed this escalation within a single calendar year.

To accompany the revelation, Talos is also releasing CAIRN, an open-source AI-powered malware hunting toolkit that works solely from metadata — never downloading or executing the binaries it analyzes. It has already helped uncover roughly 20 other samples from this new category. Here's what you need to know, and what defenders should do about it.

Key Takeaways

• CLOSEDQUORUM is a Windows implant (a 16.4 MB, 64-bit Go binary) whose C2 is delegated to a panel of four commercial LLMs: DeepSeek, Qwen, Mistral and Google Gemini. No human operator, no dedicated C2 server.
• Every 5 to 15 minutes, the models are queried in sequence and their verdicts are aggregated into a plurality vote (the interModelDiscussion mechanism). In the event of a tie, DeepSeek gets final decision priority.
• Objective: harvest credentials and crypto wallets, with exfiltration via a Discord webhook.
• Four families of decisions, constrained by a typed JSON schema: steal, inject, persist and move.
• The distributed build is inert — API keys set to dummy_api_key, fake Discord webhook. Talos theorizes that the developer sells customized copies, compiled with each buyer's API keys.
• No confirmed in-the-wild deployment at this stage, but links to carding forums dating back to 2025. The developer remains unidentified.
• CAIRN, Talos's open source hunting toolkit, works without executing the samples and has already uncovered roughly 20 other malware incorporating AI.

Recommended Tools

A word about the lab: never analyze this type of implant on your main machine. A disposable, isolated, and rebuildable VPS is more than enough — and CAIRN's "metadata only" approach even spares you from having to execute anything.

What exactly is CLOSEDQUORUM?

The direct answer: it is the first reported Windows implant whose next step is never decided by a human, but by a vote among commercial language models, executed as-is by the binary.

Technically, CLOSEDQUORUM presents itself as a 16.4 MB Go binary for 64-bit Windows. Its mission: harvest credentials and crypto wallets. Its exfiltration channel: a Discord webhook — an ordinary service, used by millions of teams, and therefore hard to distinguish from legitimate noise.

The break with the past lies not in the individual techniques, all of them known, but in the architecture. A classic RAT receives orders from an operator via a C2 server. CLOSEDQUORUM has neither: after deployment, it delegates the choice of its next action to a panel of LLMs, aggregates the verdicts, and executes. The "command" disappears from command-and-control.

A system prompt extracted from the binary

Talos extracted the system prompt directly from the binary: "You are an advanced malware strategist. Provide ONLY executable decisions." No displayed reasoning, no campaign plan: executable decisions, and nothing else.

These decisions are constrained by a typed JSON schema, which prevents the model from wandering and reduces the action space to four families:

This last point deserves a closer look: the publicly analyzed build contains no handler for the move decision. The skeleton is there, the functionality is not. That is consistent with a product sold à la carte, not with a tool for personal use.

How the four-model voting works

Direct answer: every 5 to 15 minutes, CLOSEDQUORUM queries DeepSeek, Qwen, Mistral, and Google Gemini in sequence, then executes the decision that receives the plurality vote.

The mechanism, dubbed interModelDiscussion by Talos, queries the four providers one after another and aggregates their verdicts. BleepingComputer specifies the tie-breaking procedure: in the event of a tied vote, DeepSeek has final decision priority, followed by Qwen, then Mistral and Gemini.

This redundancy is far more than an implementation detail. As WIRED points out, it makes the system fully closed: if one provider becomes unavailable, the other three take over, and there is no human input mechanism to compromise or monitor.

My take: the choice of four commercial APIs rather than a self-hosted model is a cold availability calculation. The malware inherits the resilience of four providers that each guarantee production-grade service to millions of users. That is precisely what makes the whole thing so hard to dismantle.

A malware sold as a service, not operated as a tool

Direct answer: the distributed build is deliberately inert — API keys set to dummy_api_key, a fake Discord webhook — and Talos theorizes that the developer sells customized copies, compiled with the buyer's API keys.

This is an inversion of the classic malware-as-a-service model. The buyer doesn't just purchase a binary: they plug in their own model accounts, their own keys, their own webhook. The developer, for their part, deploys nothing and operates nothing — they sell a product that each operator configures at compile time, as reported by iTNews.

The consequences for defenders are direct. There is no central infrastructure to seize, no C2 domain to sinkhole, no admin panel to take down. Each campaign's "control" legally lives with DeepSeek, Qwen, Mistral, and Google.

The context remains murky, and it's important to say so: Talos links CLOSEDQUORUM to carding forums dating back to 2025, but no in-the-wild deployment has been confirmed, and the developer remains unidentified. What we're looking at is an armed and documented product, not a confirmed active campaign.

My take: this business model is almost more notable than the technique. Malware becomes a product you configure, not one you operate. The minimum skill required to launch an operation drops another notch — and the barrier to entry for cybercrime drops with it.

CAIRN: Hunting AI malware without ever executing the binaries

Direct answer: CAIRN (Cognitive Artifact Intelligence Research Network) is Talos's open source toolkit designed to hunt down malware that integrates AI, and it works entirely from metadata — no downloads, no sample execution.

Acquisition relies on 24 filters that target the signatures of this category: calls to model providers, Python framework imports, local model runtimes. The toolkit can also detect natural-language text planted inside binaries to confuse AI analysts — a decoy specific to this new generation of malware.

Detection is organized into three tiers of YARA rules: T1 for primitive artifacts, T2 for behavioral context, T3 for operational families. Semantic clustering via embeddings and a SQLite corpus then connect the samples to one another to surface families.

The results speak for themselves: researcher Fetterman discovered roughly 20 more AI-integrating malware samples thanks to CAIRN, according to Talos. And the public YARA rule for CLOSEDQUORUM is included — detection is operational as of today.

It's also a lesson in methodology. Hunting without executing means hunting at scale: you sweep entire corpora of samples without spinning up a single VM. Faced with a category of malware that invents its own anti-AI decoys, that seems to me the most durable approach.

One last point, on the open source dynamic: it cuts both ways. On the defense side, CAIRN is landing on GitHub. On the creation side, the ecosystem is producing complete autonomous agents like OpenMontage, the first 100% autonomous and open-source video production studio. The same agentic architectures are spreading everywhere — conclusions need to be drawn on both sides of the barrier.

From LAMEHUG to CLOSEDQUORUM: fourteen months of escalation

Direct answer: in a little over a year, AI-integrated malware has gone from "LLM as an optional feature" to "multi-model consensus orchestrator with no human operator" — the exact arc Talos documents based on early CAIRN data.

Three milestones trace the slope. LAMEHUG, in July 2025, added an LLM to an otherwise classic malware. SesameOp, in November 2025, repurposed the OpenAI Assistants API as a mere C2 channel — AI as a pipe. CLOSEDQUORUM, in September 2026, entrusts the decision itself to a panel of models. Each step moves AI closer to the decision-making core.

Another signal not to ignore: AI-specific tradecraft is spreading. Talos observed a natural-language deletion-text evasion technique appear in independent samples in under 12 months. AI architecture recipes now circulate at the speed of classic TTPs.

If this escalation seems abstract, look at the rest of the landscape. OpenAI has officially confirmed Path to Astra, its first model to cross the "Critical" cybersecurity threshold of the Preparedness Framework: AI's offensive potential is no longer a laboratory hypothesis. Meanwhile, Meta's personal agent, Muse (OpenClaw), becomes a mass-market product. The same building blocks — model panels, decision loops, tool calls — are spreading from the general public to cybercrime with zero friction.

What This Changes for Defenders

Direct answer: forget hunting for the C2 server — there isn't one. Detection must shift to outbound calls to model APIs, LSASS access, and Discord webhooks.

The Nature of the Perimeter Changes

Blocking the four providers' domains is a dead end: your teams probably already use them, and the malware's multi-provider redundancy is designed to absorb the loss of any one provider. The right question isn't "who is calling these APIs?" but "which machines have no reason to call them?". The answer is a per-asset egress policy, not a domain blacklist.

Watch the Theft Trio and the Decision Window

The steal decision executes lsassDump, dumpBrowserCredentials, and extractCryptoWallets simultaneously. LSASS access followed by a POST to a Discord webhook is a sequence that deserves a dedicated alert. And the decision cadence — one cycle every 5 to 15 minutes — works in your favor: this malware deliberates where a classic C2 would react in seconds. This structural slowness is a window defenders can exploit.

Your LLM API Keys Are an Attack Surface

CLOSEDQUORUM's entire business model rests on commercial API keys compiled into a binary. Transpose that to your own fleet: a leaked key is no longer just a surprise bill — it's a potential command channel. Audit usage, rotate keys, cap budgets, and treat abnormal calls to providers as indicators of compromise in their own right.

Deploy the YARA Rule, Test CAIRN

Talos' public rule covers CLOSEDQUORUM, and CAIRN lets you sweep your historical samples without executing a single one. Two concrete actions, doable this week.

A sore point, and it needs to be said: CLOSEDQUORUM's architecture — model panel, voting, JSON tool schema, webhook — is exactly what you build when following a guide like Build Your First Autonomous AI Agent. The technique is neutral; the difference lies in intent. Defenders who know how to build these pipelines are also the ones who know where to place detectors. That's one more reason not to leave this culture to attackers alone.

❌ Common Mistakes

Mistake 1: "No confirmed deployment" means "no threat"

What's wrong: the absence of in-the-wild confirmation is a state of knowledge, not a guarantee. Links to carding forums date back to 2025, roughly twenty other AI malware strains already exist, and the product is sold pre-configured per buyer. The fix: deploy Talos's YARA rule and run a CAIRN pass this week, not this quarter.

Mistake 2: Looking for C2 infrastructure to block

What's wrong: there is no dedicated server, no malicious domain, no admin panel. The C2 lives on four legitimate providers, and blocking these APIs wholesale breaks your own tools without guaranteeing anything. The fix: per-asset egress policies, and behavioral detection (LSASS, outbound webhooks) rather than blocklists.

Mistake 3: Believing autonomy rhymes with sophistication

What's wrong: the distributed build is an inert binary, with dummy keys and a missing move handler. CLOSEDQUORUM's innovation is architectural, not technical. Overestimating it leads to disproportionate responses; underestimating it means ignoring the autonomy arc taking shape. The fix: read Talos's analysis, calibrate, and track the arc over time with CAIRN.

❓ Frequently Asked Questions

Has CLOSEDQUORUM already been used in attacks?

No in-the-wild deployment has been confirmed at this stage. Talos links the implant to carding forums dating back to 2025, without identifying the developer. The distributed build is inert — dummy API keys and webhook — which supports the hypothesis of sales as customized copies, compiled with each buyer's API keys.

Which AI models drive CLOSEDQUORUM?

Four commercial providers: DeepSeek, Qwen, Mistral and Google Gemini, queried in sequence every 5 to 15 minutes. Their verdicts are aggregated into a plurality vote via the interModelDiscussion mechanism. In the event of a tie, DeepSeek has final decision priority, followed by Qwen, then Mistral, then Gemini.

What does CAIRN actually deliver?

CAIRN hunts AI-integrated malware without downloading or executing the binaries, working solely from metadata: 24 acquisition filters, three-tier YARA rules, embedding-based semantic clustering and a SQLite corpus. Open source and available on GitHub, it has already led to the discovery of around 20 additional samples in this category.

Can this malware be countered by blocking the models' APIs?

That would be counterproductive. The four providers are used by legitimate applications, and the multi-provider redundancy is precisely designed to survive the loss of any one of them. The right approach is a per-asset egress policy: only machines with a legitimate need access these APIs; all others are blocked and generate alerts.

How does it differ from LAMEHUG, PromptLock or SesameOp?

LAMEHUG (July 2025) used an LLM as an optional feature; PromptLock hosted a local OpenAI model to generate Lua ransomware scripts; SesameOp hijacked the OpenAI Assistants API as a C2 channel. CLOSEDQUORUM raises the bar: the model panel decides on every step on its own, with no human operator and no control server.

✅ Conclusion

In fourteen months, AI-integrated malware has gone from optional assistant to autonomous decision-maker, and CLOSEDQUORUM — even though it probably hasn't been deployed yet — is already setting the architecture for the next generation: a C2 that votes, executes, and blends into the mundane traffic of model APIs. Three actions are called for: Talos's YARA rule, a CAIRN pass over your samples, and serious governance of your API keys — start with Cisco Talos's full analysis.