How does CLOSEDQUORUM use AI models as command and control?

A ModelOrchestrator component queries each provider in sequence with a system prompt that reads 'You are an advanced malware strategist. Provide ONLY executable decisions,' plus a template listing the host's hostname, OS, CPU count, Windows version and admin status. Each model must return typed JSON with a Decision field limited to a fixed vocabulary (steal, inject, persist, move). A plurality vote picks the action; ties resolve deterministically in favour of DeepSeek. If every model refuses or times out, the loop sleeps and retries at randomised 5 to 15 minute intervals rather than acting.

Is CLOSEDQUORUM active in the wild?

Not as far as Cisco Talos can confirm. The publicly observed build is an inert template with placeholder API keys (dummy_api_key) and a dummy Discord webhook, so it is non-functional as distributed. Development builds show credentials injected at compile time, which points to a credentials-as-a-service model where a developer builds a custom binary per operator. Artifacts in the binary link the developer to carding posts on criminal forums dating to 2025. Talos calls it an early, limited demonstration rather than a sophisticated campaign.

How do you detect CLOSEDQUORUM-style AI malware?

No single indicator identifies it, because the C2 endpoints are legitimate AI APIs used by thousands of apps. Talos recommends correlating behaviours: AI-provider API traffic from an unexpected Windows executable, similar requests to several model providers within a short interval, LSASS access, suspended-process injection, WMI event-subscription persistence, a WindowsUpdate Run key, Discord webhook traffic from the same process, and repeated execution every 5 to 15 minutes. Talos's open-source CAIRN toolkit scans binaries for prompt templates, API endpoints and jailbreak terms without executing them.

Quick Answer

What Is CLOSEDQUORUM? LLM-Run Malware Explained (2026)

Q: What is CLOSEDQUORUM?

CLOSEDQUORUM is a 16.4 MB, 64-bit Windows implant written in Go that Cisco Talos disclosed on September 22, 2026 as the first publicly documented malware with fully autonomous, LLM-driven command and control. Instead of taking orders from an attacker-run C2 server, it sends host context to up to four commercial LLM APIs (DeepSeek, Qwen, Mistral and Google Gemini), tallies their votes, and executes the winning action: steal credentials and crypto wallets, inject shellcode, or establish persistence. Stolen data is exfiltrated to a Discord webhook. Talos found it through its CAIRN research toolkit and has no confirmation of in-the-wild deployment.

Published: September 24, 2026

The short answer

CLOSEDQUORUM is the first publicly documented malware that outsources its tactical decisions to a panel of commercial LLMs. Cisco Talos disclosed it on September 22, 2026 alongside CAIRN, an open-source toolkit for hunting AI-integrated malware. After landing on a Windows machine, the implant describes the host to DeepSeek, Qwen, Mistral and Google Gemini, asks each for a JSON decision, takes the plurality vote, and executes it: dump credentials and crypto wallets, inject shellcode, or install persistence. There is no attacker-owned C2 server to block and no human operator in the loop. Talos has not confirmed any in-the-wild infections; the public build ships with placeholder API keys and is inert.

What Cisco Talos found

	CLOSEDQUORUM
Disclosed	September 22, 2026 (Cisco Talos)
Binary	16.4 MB, 64-bit Windows PE, compiled in Go with CGO (mixed Go/C for direct syscalls)
C2 model	”LLM-as-C2”: up to four providers, plurality vote
LLM panel	DeepSeek, Qwen, Mistral, Google Gemini
Decision vocabulary	`steal`, `inject`, `persist`, `move` (move has no handler in the public build)
Objective	Harvest user credentials and cryptocurrency wallets
Exfiltration	Discord webhook, AES-256-GCM with a date-derived key, Base64, 1,900-byte chunks at one-second intervals
Polling cadence	Five-minute initial delay, then randomised 5 to 15 minute intervals
In-the-wild status	Unconfirmed; public build has `dummy_api_key` and `dummy_webhook_url`
Attribution	Developer artifacts tie to carding-forum posts from 2025
Discovery method	CAIRN (Cognitive Artifact Intelligence Research Network), released the same day

How the “closed quorum” works

The name is literal. A quorum is a decision-making body that needs a minimum number of participants to act; this one is closed because no human is admitted.

Initialisation. gatherSystemInfo() records hostname, OS architecture, CPU count, Windows version and whether the process has admin rights.
Prompting. The ModelOrchestrator sends each provider a system prompt (“You are an advanced malware strategist. Provide ONLY executable decisions.”) plus a per-execution template with TARGET: %s filled in from the host data. The template enumerates the allowed choices.
Voting. Responses are deserialised into a Go struct and collected as a []LLMDecision slice. interModelDiscussion() counts each provider’s Decision value in a map[string]int; the highest count wins. Because the comparison is a strict “less than” over the slice in submission order, ties go to the first provider queried, so the tie-break is deterministic and biased toward DeepSeek.
Execution. steal runs lsassDump(), dumpBrowserCredentials() and extractCryptoWallets() together. inject generates shellcode and uses either process hollowing (PEB-walk) or Early Bird APC injection. persist sets a WindowsUpdate Run key, creates a scheduled task via schtasks.exe, and registers a permanent WMI event subscription that runs C:\Windows\Temp\wmi.ps1 every 60 seconds.
Reporting. The chosen action is posted to the operator’s Discord webhook in real time; stolen files follow, encrypted and chunked.
Fallback. If all four models refuse, time out or return malformed JSON, the fallback decision is a string with no capability handler, so the loop sleeps and retries rather than defaulting to an attack.

The multi-provider design is about resilience as much as aggregation: one model hitting a safety guardrail does not stop the implant if the other three answer.

Why it matters more than its sophistication suggests

Talos is explicit that CLOSEDQUORUM is not advanced malware. Its individual techniques (LSASS dumping via MiniDumpWriteDump, ETW suppression by overwriting EtwEventWrite with a RET, time-keyed payload decryption, Windows-Update-themed masquerading) are all well catalogued in MITRE ATT&CK. What is new is the architecture:

No attributable C2 infrastructure. Traditional C2 needs a domain, an IP and a listener that defenders can track and block. CLOSEDQUORUM talks to the same AI endpoints thousands of legitimate applications use every day.
Effort displacement. Talos frames AI’s impact on offence as three dimensions: speed, scale, and now effort displacement, where an entire phase of the attack chain moves from the operator to the system. An operator can deploy the binary and go offline; the LLM panel runs the campaign.
A template for other objectives. Encoding tactical logic as model-readable context and converting structured model output straight into execution is a scaffold that could be reused for lateral movement, ransomware staging or data discovery.

The weaknesses are equally structural: provider refusals, rate limits, malformed output, a predictable tie-break, a tiny action vocabulary and total dependence on commercial APIs (and therefore on API keys that providers can revoke).

What CAIRN is

CAIRN (Cognitive Artifact Intelligence Research Network) is the open-source research toolkit Talos released on September 22, 2026 that surfaced CLOSEDQUORUM. It is metadata-first: it hunts, classifies and tracks AI-integrated malware by scanning binaries for prompt templates, AI-provider API endpoints and jailbreak vocabulary without executing them. Talos says AI-integrated malware moved in roughly one year from optional AI helpers inside conventional tooling to autonomous command and control, and that CLOSEDQUORUM is the first in a series of CAIRN findings it plans to publish.

Detection guidance

Talos’s advice is to detect the chain of correlated behaviours, not to block AI domains:

Signal	Why it matters alone vs. together
AI-provider API traffic from an unexpected Windows executable	Common for legitimate apps; suspicious from an unknown Go binary
Similar requests to several model providers within seconds	Few legitimate apps fan out to DeepSeek, Qwen, Mistral and Gemini at once
Structured prompts carrying host context or offensive language	Visible only with TLS inspection or provider-side telemetry
LSASS access, suspended-process injection, WMI persistence	Classic malware techniques
Discord webhook traffic from the same process or host	Unusual for non-chat software
Repeated execution at randomised 5 to 15 minute intervals	Sandbox-evasion pattern

Legitimate software may do any one of these. Very little legitimate software contacts four AI providers and Discord while also reading LSASS memory and creating WMI subscriptions.

Context: the week it landed

CLOSEDQUORUM arrived in the same week that Palo Alto Networks Unit 42 launched a multi-model defensive harness (Continuous Frontier AI Defense, combining Claude Mythos 5, GPT-5.6-Cyber and open-weight models), and a day before executives from OpenAI, Anthropic, DeepSeek and Moonshot briefed the UN Security Council on AI and international security. Offence and defence are converging on the same design: several models, structured outputs, autonomous loops. For how model providers are gating their own cyber-capable variants, see What is Claude Mythos 5? and for the defensive side of agent deployment, How to deploy a computer-use agent safely.

Last verified: September 24, 2026.