A Windows implant that hands its tactical decisions to a committee of commercial AI models, with no human operator and no attacker-run server in the loop, has been documented for the first time, according to Cisco Talos. The researchers disclosed the malware, which they call CLOSEDQUORUM, on September 22 alongside CAIRN, a new open-source toolkit built to hunt AI-integrated malware without ever running it.
Talos says CLOSEDQUORUM is, to its knowledge, the first publicly documented Windows implant to delegate command-and-control (C2) to large language models. Once running on a compromised machine, it queries up to four commercial LLM providers, DeepSeek, Qwen, Mistral and Google Gemini, asks each to pick the next move from a short, fixed menu, and executes whichever option wins a plurality vote. Ties go to DeepSeek, then Qwen, Mistral and Gemini in that order.
"The session is closed; no humans are admitted," Talos researcher Ryan Fetterman wrote in the technical analysis. "Four models are queried in sequence, their independent verdicts tallied, and the binary acts, based on their judgment."
A committee in place of a server
The implant is a 16.4MB, 64-bit Windows executable written in Go. Its menu of actions is small: steal (harvesting Windows credentials, saved browser passwords and cryptocurrency wallet data), inject code into other processes, or establish persistence. A hardcoded system prompt extracted from the binary tells each model it is "an advanced malware strategist" and must return only executable decisions, in a rigid JSON format the implant can parse. Responses that don't fit are discarded. Results and stolen material are sent, encrypted, to an operator-controlled Discord channel.
The design choice that matters, Talos argues, is treating AI providers themselves as the C2 infrastructure. Traditional malware phones home to domains and IP addresses that defenders can track, block and publish in threat feeds. CLOSEDQUORUM instead talks to API endpoints used by thousands of legitimate applications every day.
There are important caveats. Talos has not confirmed any in-the-wild deployment. The publicly observed build is an inert template with placeholder API keys and a dummy webhook, so researchers did not watch the full loop run end to end; their conclusions rest on static analysis and on development builds showing credentials injected at compile time. Talos believes the developer sells customized builds to individual operators, a credentials-as-a-service model, and says artifacts in the binary tie the author to carding-related postings on criminal forums dating back to 2025.
CAIRN: hunting the traces AI leaves behind
CLOSEDQUORUM was found with CAIRN (Cognitive Artifact Intelligence Research Network), which Talos released on GitHub the same day. The toolkit rests on the observation that AI-integrated malware leaves behind what Talos calls cognitive artifacts: prompt templates, provider endpoints, API key prefixes, jailbreak terms and text written to fool AI-based sandboxes. CAIRN works entirely from metadata, with no binary downloads or execution, using up to 24 acquisition filters and a three-tier classification scheme that runs from the simple presence of AI strings up to confirmed, named malware families.
Talos has been running these hunts against malware development since July 2025, when Ukraine's CERT-UA reported LAMEHUG, the first AI-integrated samples seen in the wild. The headline finding is speed: the progression from an LLM as an optional feature to a fully autonomous multi-model orchestrator with no human operator "filled in within a single calendar year," Fetterman wrote. The team also traced an AI-sandbox evasion technique to a named red team instructor and then found it in unrelated actors' samples within 12 months of its first confirmed in-the-wild use.
Talos is candid about the tool's limits, noting that many low-tier hits turn out to have no genuine AI integration and that final verdicts still require reverse engineering.
Why It Matters
Most discussion of AI in offensive operations has centered on speed and scale: faster phishing lures, more code variants. Talos argues CLOSEDQUORUM shows a third dimension it calls effort displacement, in which an entire phase of an attack moves from the human to the system. "Human operators are bound by attention, working hours, and cognitive load," Fetterman wrote. "It does not go offline when the attacker sleeps."
The malware itself is not sophisticated, and Talos says so. Its significance is architectural. It shows that encoding attack logic as a constrained menu for a model, then executing the model's choice, works today with off-the-shelf APIs, and that scaffolding can be ported to other objectives. It also shifts pressure onto AI providers, whose refusal behavior, abuse monitoring and rate limits now sit directly inside an attacker's control loop, and onto defenders who can no longer count on blocking a known C2 domain.
The same day, Palo Alto Networks launched Unit 42 Continuous Frontier AI Defense, an always-on offensive testing service built on Anthropic's Claude Mythos 5 and OpenAI's GPT-5.6-Cyber. Taken together, the two announcements show attackers and defenders both converging on multi-model setups.
What to Watch
Talos recommends behavioral detection over domain blocking. "Legitimate applications may contact DeepSeek, OpenRouter, Mistral, Gemini, or Discord independently," Fetterman wrote. "Far fewer should contact several of them while also accessing LSASS, injecting into suspended processes, or creating WMI persistence." Expect endpoint vendors to add rules that correlate AI-API traffic from unexpected executables with credential-theft behavior.
Autonomy also brings new weak points. Provider refusals, rate limits, malformed output and a predictable tie-breaking order are all potential chokepoints, and how quickly DeepSeek, Alibaba's Qwen team, Mistral and Google detect and cut off keys used this way will be a real test of provider-side abuse controls.
Talos calls CAIRN the first in a series and has promised more findings. The key signals will be whether a configured CLOSEDQUORUM build turns up in a live intrusion, and whether the voting design spreads beyond credential theft to other attack phases. "We have an open window to study this transition," Fetterman wrote, with the goal of building defenses before autonomous operations "become more capable and widespread."
“The session is closed; no humans are admitted.”— Ryan Fetterman, Security Researcher, Cisco Talos