A panel of AI models, not a human, runs the show
Cisco's Talos threat intelligence team has documented a Windows implant that hands its command-and-control decisions to a vote among commercial artificial intelligence (AI) models rather than an attacker sitting at a keyboard. Talos calls the sample CLOSEDQUORUM and describes it as the first publicly documented Windows implant built this way: once it lands on a machine, it does not wait for instructions from a remote server. It asks a panel of large language models (LLMs) - AI systems trained to generate and reason over text - what to do next, and acts on whatever the majority says.
Talos found the sample using a new toolkit it released the same day, called CAIRN (Cognitive Artifact Intelligence Research Network), built specifically to hunt for malware that leans on AI infrastructure.
How the voting works
CLOSEDQUORUM is a 16.4-megabyte, 64-bit Windows executable written in Go. When it needs to decide what to do on an infected machine, it queries up to four commercial AI providers in sequence - DeepSeek, Alibaba's Qwen, Mistral, and Google's Gemini - and requires each to answer inside a fixed JSON (JavaScript Object Notation) data format rather than free text. The implant tallies the four responses and acts on whichever action gets the most votes; if the vote is split, DeepSeek's answer serves as the tiebreaker.
The effect is that the AI providers' own servers function as the malware's command infrastructure. There is no attacker-run server issuing orders that defenders could trace and take down - just ordinary API calls to mainstream AI services, mixed in with legitimate traffic to the same endpoints.
What it does once it decides
The vote resolves to one of four possible actions, though Talos found only three actually implemented in the sample it examined:
- Steal - dumps credentials from LSASS (the Windows process that holds cached logon secrets), lifts saved passwords from Chrome, Edge and Firefox, and pulls funds-related data from cryptocurrency wallets including MetaMask and Exodus.
- Inject - plants code in other running processes using asynchronous procedure calls or process hollowing, both standard evasion techniques.
- Persist - keeps itself alive across reboots through Windows Registry run keys, scheduled tasks, or WMI (Windows Management Instrumentation) event subscriptions.
- Move - a fourth action for lateral movement to other machines exists in the code but has no working handler in this build.
Anything it steals is encrypted with AES-256-GCM, a standard authenticated-encryption scheme, before being sent out through a Discord webhook rather than a dedicated server. To make analysis harder, the implant fires its decision cycle at randomized intervals of five to fifteen minutes and suppresses ETW (Event Tracing for Windows), the logging subsystem that many endpoint security tools rely on.
Who built it, and whether it has been used
Talos says it found no evidence CLOSEDQUORUM has been deployed against a real target: the publicly available build ships with placeholder credentials that do not actually work, suggesting it may be a proof of concept or a work in progress rather than an active campaign. Artifacts inside the binary, however, tie its developer to posts on criminal forums about carding - trading in stolen payment card data - going back to 2025.
Talos places the sample on an autonomy escalation arc it has been tracking. Researchers first saw malware experimenting with optional LLM-generated code back in mid-2025, in samples known as LAMEHUG. In roughly a year, that has progressed from AI as an occasional scripting assist to AI as the thing actually making operational decisions, with no human in the loop at all once the malware is running.
How CAIRN found it
CAIRN does not run or detonate suspicious binaries. It works entirely from metadata - the traces a program leaves behind, such as prompt templates, embedded API keys, references to AI provider endpoints, and jailbreak-style phrases used to coax restricted output from a model. The toolkit applies 24 filters tuned to this kind of evidence, things like hardcoded calls to api.openai.com or api.anthropic.com, imports of AI frameworks like LangChain or LiteLLM, or signs of local model runners such as Ollama or llama.cpp. Matches get stored and scored using a three-tier system of YARA rules, a pattern-matching format widely used in malware research: one tier for basic AI-related artifacts, one for behavioral context, and one for attributing a sample to a known malware family. Talos has published CAIRN on GitHub under the MIT license, along with six SHA256 file hashes and a YARA rule for CLOSEDQUORUM itself.
What this means in practice
CLOSEDQUORUM has not been caught in an actual breach, so there is no incident to respond to today. What it does change is the shape of what defenders need to watch for: outbound connections to mainstream AI provider APIs from processes that have no business making them, credential-theft behavior that does not correlate to any known command server, and Discord webhook traffic carrying encrypted data. Security teams that already block or monitor AI API traffic from endpoints for data-loss reasons get a head start here, since the same visibility that stops an employee pasting secrets into a chatbot would also catch this pattern.
