CLOSEDQUORUM malware delegates C2 decisions to four AI models

Malware that votes on its own next move

Cisco Talos researchers have documented the first Windows implant that delegates tactical command-and-control decisions to a panel of commercial large language models. The malware, named CLOSEDQUORUM, queries four AI providers—DeepSeek, Qwen, Mistral, and Gemini—and executes whichever action receives the most votes from the models.

Unlike traditional malware that requires continuous commands from a human operator or tasking from a dedicated C2 server, CLOSEDQUORUM operates autonomously after deployment. It presents each LLM with a fixed menu of options: steal data, inject code, or establish persistence on the compromised machine. Each model casts a vote, and the majority choice determines the malware's next action. When votes tie, the malware follows a predetermined hierarchy favoring DeepSeek first.

The 16.4MB implant is written in Go. Talos researchers conducted static analysis confirming the decision loop functions as designed, though the examined sample contained placeholder API keys and a dummy webhook address, preventing observation of full execution against a live target.

Why it matters

CLOSEDQUOROM represents a fundamental shift in malware architecture. By eliminating the need for attacker-controlled infrastructure like C2 servers—which defenders routinely hunt, block, and add to threat feeds—this approach makes traditional detection methods less effective. The autonomous decision-making capability also reduces operational overhead for attackers while potentially accelerating the pace of intrusions. Security teams now face adversaries that can operate without the communication patterns and infrastructure dependencies that have long been reliable indicators of compromise.

CAIRN framework hunts AI-integrated threats

To help security practitioners identify malware leveraging AI capabilities, Cisco Talos released CAIRN, an open-source framework that classifies and analyzes these threats using only file metadata—no downloading or executing samples required.

The framework searches for what Talos calls cognitive artifacts: embedded prompts, provider API endpoints, orchestration logic, and evasion text designed to fool AI-based sandbox scanners. CAIRN organizes findings into three tiers, from basic detection of AI-related strings to confirmed identification of named malware families.

Ryan Fetterman, security researcher at Cisco Talos, explained that CAIRN employs four distinct analysis strategies suited to different investigation phases, combining surface expansion to find unknowns, pivoting to map relationships, and corpus analysis to identify structural patterns.

Talos has been running CAIRN against malware development since July 2025, when CERT-UA first reported LAMEHUG—the earliest known sample of AI-integrated malware. The researchers discovered that AI-specific evasion techniques are spreading between attackers, with one method traced to a named red team instructor appearing in unrelated malware samples within 12 months of its initial wild use.

An open window for defenders

Fetterman noted that CLOSEDQUORUM represents an early and limited example, but one that makes an emerging threat model concrete. "The advantage for defenders is that this progression is still only beginning," he wrote. "We have an open window to study this transition, with the aim of developing the detections, controls, and response strategies needed before autonomous operations become more capable and widespread."

These findings were first reported by Help Net Security on September 22, 2026.