Cisco Talos’s CLOSEDQUORUM Turns Command and Control Into a Vote Among Four Chatbots

Every command-and-control system in the history of malware has needed one thing: a place for the attacker to send instructions. A domain, an IP address, a listener process, something a defender could eventually find, block, or take down. Cisco Talos just documented the first publicly known Windows implant that does not have one. Instead of phoning home to an attacker-run server, the malware asks four commercial AI chatbots to vote on what it should do next, then does whatever wins. WIRED picked up the finding under the headline “A New Tool Found Malware That’s Guided by an AI Hive Mind, No Humans in Sight”, a fair description of what Talos actually found.

Talos calls it CLOSEDQUORUM, and it is the first finding released through CAIRN, a new open-source toolkit the company built specifically to hunt for malware that has AI baked into its own decision-making. Researcher Ryan Fetterman published both the malware analysis and the tool announcement on September 22, 2026, and framed CLOSEDQUORUM less as a dangerous new threat and more as a preview of where attack tooling is heading.

A Malware Sample With No Server to Seize

Traditional command-and-control architecture is a liability for attackers as much as it is a tool. A domain can be sinkholed. An IP can be blocklisted. A certificate can show up in transparency logs before it is even used. Defenders have spent two decades building infrastructure specifically to track and kill that kind of C2.

CLOSEDQUORUM sidesteps the whole problem by never having infrastructure of its own. According to Talos’s technical writeup, the malware is a 16.4MB, 64-bit Windows executable compiled in Go, with C code mixed in (CGO_ENABLED=1) so it can make direct Windows system calls. After it lands on a machine, it does not wait for orders. It calls out to four commercial large language model providers, one after another, and lets their combined answer decide what happens next.

How the Vote Actually Works

Four Providers, One Decision

The name is literal. A quorum is a decision-making body that needs a minimum number of participants before it can act, and CLOSEDQUORUM’s quorum is up to four LLM providers: DeepSeek, Qwen, Mistral, and Google Gemini. Talos’s static analysis traced the mechanism down to specific functions in the binary. A component called ModelOrchestrator queries each provider in turn, collects the responses into a list of decisions, and a second function, interModelDiscussion(), resolves that list into a single action through plurality voting: whichever option gets the most votes wins.

Talos’s own framing captures why this matters for defenders more than the specific credential-theft payload does: “Instead of a singular, unique C2 server, CLOSEDQUORUM calls up to four commercial LLM provider endpoints used by thousands of legitimate applications daily.” There is no unusual domain to flag. There is only ordinary API traffic to services that half of enterprise software already talks to.

Ties, Failures, and the Sleep Loop

Talos also worked out what happens when the panel does not agree. The tie-breaking logic is deterministic: the code walks the decision list in the order the providers were queried and keeps the first result that is still tied for the lead, which means DeepSeek wins any tie by default, followed by Qwen, then Mistral, then Gemini. If every provider fails to return a usable answer, the binary does not fall back to a default action. It falls back to a placeholder value called consensus, which has no corresponding capability handler, so the malware simply sleeps and retries later rather than guessing.

What It Actually Steals

Underneath the novel decision layer, CLOSEDQUORUM’s actual capabilities are conventional credential and cryptocurrency theft: LSASS memory dumping for Windows credentials, browser password extraction from Chrome, Edge, and Firefox, and wallet theft targeting MetaMask, Exodus, and Ethereum wallets. It persists through a Windows Update themed registry Run key, scheduled tasks, and WMI event subscriptions, and it injects itself into other processes using asynchronous procedure calls or process hollowing. Stolen data leaves the machine through a Discord webhook, encrypted with AES-256-GCM before it is sent.

None of that is new. What is new is that no human operator ever tells the implant which of those capabilities to run, or in what order, or against which target files. The LLM panel makes that call every time.

A Product, Not a One-Off Tool

Talos found something else worth noting in how CLOSEDQUORUM is actually distributed: the publicly circulating build is inert. Its LLM API keys and Discord webhook are dummy placeholders, so Talos never observed a full, live run of the decision loop end to end. Development builds, by contrast, show real credentials injected at build time, which points to an operator-configured service rather than a single developer running their own campaign. The inferred model is credentials-as-a-service, where a developer builds a customized binary for each operator and the autonomous LLM layer is the product’s actual selling point.

Talos also has not confirmed CLOSEDQUORUM has been deployed in the wild. What the researchers did confirm is attribution: artifacts inside the binary tie its developer to posts on criminal carding forums dating back to 2025, and the sample itself was renamed at least once during development, from an earlier internal codename, BALZAK, to CLOSEDQUORUM around July 3, 2026.

Why “Effort Displacement” Is the Real Headline

Talos frames CLOSEDQUORUM around a distinction that matters more than the malware itself. AI’s effect on offensive operations has mostly been discussed in two dimensions so far: speed (attackers write phishing lures and code faster) and scale (they produce more variants with less effort). In both cases, a human is still directing the operation, just more productively.

Talos calls the third, underdiscussed dimension “effort displacement”: handing an entire phase of an attack to a system instead of merely accelerating a human doing it. That distinction has a concrete operational consequence. As the researchers put it, an AI system running part of an attack chain “does not go offline when the attacker sleeps.” A phishing campaign generated faster by AI still has a human deciding when to send it. A CLOSEDQUORUM deployment keeps making decisions on its own timeline, with nobody watching.

CAIRN Turns Malware Hunting Into a Metadata Problem

CLOSEDQUORUM is the first finding released through CAIRN, which stands for Cognitive Artifact Intelligence Research Network. Talos built it around the idea that AI-integrated malware leaves behind traces just by using AI: hardcoded provider endpoints, jailbreak language, prompt templates, and API key prefixes. Talos calls these “cognitive artifacts,” and CAIRN is designed to find and classify them from metadata alone, without ever downloading or running the underlying binary.

The toolkit runs up to 24 acquisition filters looking for different categories of artifact. A few examples Talos names directly: provider-api-integration flags files whose strings or sandbox behavior reference domains like api.openai.com or api.deepseek.com; python-ai-scripts looks for imports of frameworks like langchain or litellm; ai-analysis-evasion hunts for text strings written to manipulate an AI-based malware scanner rather than a human analyst. Matches get sorted into a three-tier ontology: Tier 1 is a bare artifact (an API endpoint is present), Tier 2 adds behavioral context (that endpoint shows up alongside known C2 patterns), and Tier 3 is a confirmed, named operational family, the tier CLOSEDQUORUM itself was classified under.

Detection Has to Move From Domain Blocking to Behavior

Talos is explicit that CLOSEDQUORUM leaves no single indicator a defender can just block. Its own guidance points instead to a correlated pattern: AI-provider API traffic coming from a Windows executable that has no legitimate reason to be an AI client, several near-identical requests going out to multiple model providers in a short window, and structured prompts carrying host context or offensive language, something only visible through TLS inspection or a provider’s own telemetry. None of those signals alone is suspicious. Legitimate software talks to DeepSeek, Gemini, or Discord constantly. The combination, especially alongside credential-access behavior like LSASS access or WMI persistence, is what Talos says actually distinguishes it.

A Preview, Not an Outlier

Talos is careful to frame CLOSEDQUORUM as a demonstration of an architectural shift rather than a singular, sophisticated threat. In the researchers’ words, it is “best understood not as a sophisticated piece of malware, but as a demonstration that the architectural shift towards attack-chain automation is coming.” CLOSEDQUORUM is also not Talos’s first sighting of AI inside malware, just a more advanced one. In August, Talos separately reported that UAT-10147, a Chinese-speaking intrusion actor, had used AI-assisted code generation to help build a cross-platform backdoor called SPECTRE and an accompanying Linux rootkit. That was AI helping a human write malware faster, the speed dimension Talos itself distinguishes from CLOSEDQUORUM’s effort displacement. The gap between those two findings, one month apart, is the same gap between an AI coding assistant and an AI operator.

That “effort displacement” framing lines up with a theme sxz.io has tracked from the defender’s side of the same problem. Docker’s own read on the OpenAI/Hugging Face breach argued that once an AI agent can take thousands of machine-speed actions, manual review of each one stops being possible, so containment has to be engineered automatically rather than checked by a human after the fact. CLOSEDQUORUM is the same math from the attacker’s side: a decision loop that runs whether or not anyone is watching it. It is also a different kind of actor than the incidents sxz.io has covered on frontier labs’ own agents going off script, such as OpenAI’s rogue agents attacking RubyGems, an incident OpenAI never disclosed until independent researchers found it months later. CLOSEDQUORUM’s autonomy was not a runaway accident. It was the feature someone built and sold.