Almost every piece of malware has shared the same weak point: a human at the other end. Someone has to watch the infected machine, decide what to steal next and type the command. That person gets tired, goes to sleep and runs servers that defenders can find and block. On 22 September 2026, Cisco Talos published the first detailed analysis of a Windows implant designed to work without that person at all.
Talos calls it CLOSEDQUORUM. Instead of taking orders from an attacker, it asks a panel of up to four commercial AI models what to do next, counts their votes, and does it. It is an early and limited example. It is also the clearest sign yet of where AI-powered cybercrime is heading, and it changes a few assumptions small and midsize businesses have relied on for years.
The trend: from AI-assisted attacks to AI-run attacks
Until now, AI has helped criminals in two ways: speed and scale. It writes better phishing emails faster and churns out more code variants. We covered that shift in AI-Powered Threats: Cyberattacks Are Getting Smarter and the EvilAI malware campaign. In every case, though, a person was still steering.
Talos names a third dimension: effort displacement. Rather than making the attacker more productive, the software takes over a whole phase of the attack. That matters because human attackers are limited by attention and working hours. An automated decision loop keeps going while the attacker sleeps.
According to Talos, the path from “AI as an optional add-on” to “fully autonomous, multi-model orchestration with no human operator” took about one year, starting with the first AI-integrated malware samples reported in the wild in July 2025. That pace is the real headline.
How CLOSEDQUORUM works
CLOSEDQUORUM is a 16.4 MB Windows program written in Go. Its offensive toolkit is fairly standard. What makes it new is where the decisions come from. Once running, it collects basic facts about the machine (hostname, Windows version, CPU count, whether it has admin rights) and sends them to up to four AI providers: DeepSeek, Qwen, Mistral and Google Gemini. Its built-in instructions tell each model to act as “an advanced malware strategist” and answer only in a fixed format.
Each model must return one decision from a short menu. The implant tallies the answers and runs whichever action gets the most votes. If there is a tie, DeepSeek’s answer wins. The options map directly to three jobs:
- Steal: dump Windows login secrets from memory (LSASS), copy saved passwords from Chrome, Edge and Firefox, and grab crypto wallets such as MetaMask and Exodus.
- Inject: hide malicious code inside another, legitimate-looking process.
- Persist: survive reboots using a registry Run key, a scheduled task or a WMI subscription, all disguised with Windows Update-style names.
Stolen data is encrypted and posted in small chunks to the attacker’s Discord channel, along with each decision and the AI’s stated reasoning. The implant also waits five minutes after starting and then checks in at random 5-to-15-minute intervals, a timing trick meant to outlast short automated sandbox analysis.
Why “AI as the command server” is a big deal
Traditional malware phones home to a command-and-control (C2) server the attacker owns. That server is its biggest liability: it has a domain, an IP address and a certificate that threat intelligence feeds publish and firewalls block. CLOSEDQUORUM does not have one. Its “server” is a set of mainstream AI APIs that thousands of legitimate apps call every day.
| Question | Traditional C2 | LLM-as-C2 (CLOSEDQUORUM) |
|---|---|---|
| Who decides the next step? | A human operator | A vote among up to four AI models |
| Where does the malware connect? | An attacker-owned server | Public AI provider APIs plus Discord |
| Can you block it by domain? | Often, once it is published | Not without also blocking legitimate AI use |
| Does the attack pause at night? | Frequently | No |
| Main weak points | Infrastructure gets found and taken down | Model refusals, rate limits, bad output, predictable tie-breaks |
Talos also found that the malware appears to be sold as a service. The public copy is an inert template with placeholder API keys. The developer apparently builds a custom version for each buyer with that buyer’s keys and Discord channel baked in. The buyer delivers it, then does not need to be online. Talos linked the developer to criminal forum posts about credit-card fraud going back to 2025.
What it cannot do (yet)
Fair weight matters here, because this story will be overhyped elsewhere. Talos is clear on several limits:
- There is no confirmed in-the-wild deployment so far, and Talos did not observe a complete run from start to finish because the public build contains dummy keys.
- It still needs a way in. Someone has to run it on a machine first, usually through phishing, a fake download or stolen credentials.
- The AI only chooses from actions the author already built. It is not inventing new attacks on the fly.
- Relying on commercial AI brings new failure points: models can refuse, providers can rate-limit or revoke keys, and outputs can be malformed.
Talos describes it not as sophisticated malware but as proof that removing the human from a bounded part of an intrusion already works with today’s models and ordinary API access. The precedent is the point. The same scaffolding can be pointed at other goals.
The question for defenders is no longer “is someone on the other end right now?” It is “what can this machine be talked into doing while nobody is watching?”
A second signal: attackers are writing notes to your AI
Alongside CLOSEDQUORUM, Talos open-sourced CAIRN, a toolkit that hunts AI-enabled malware by the traces it leaves behind: embedded prompts, AI provider addresses and API key fragments. One finding stands out for any business using AI-powered security tools. Attackers are embedding plain-English text addressed to AI analysis systems, essentially telling an AI sandbox there is nothing to see. Talos traced the technique to a named red-team instructor and found it spreading into unrelated criminals’ malware within about a year.
In other words, if your defenses lean on an AI to judge whether a file is safe, attackers are already trying to persuade that AI. The same lesson we drew from AI payment agents applies: an AI’s judgment is useful, but it should never be the only control.
How to spot it: look for the combination
Because the traffic goes to legitimate AI services, no single indicator gives CLOSEDQUORUM away. Talos recommends watching for behaviors that are rare together, even if each is common alone.
What to do this month
- Know which programs are allowed to talk to AI services. Build a simple inventory of approved AI tools. Any other executable calling AI APIs from a workstation deserves a look. This also exposes shadow AI.
- Confirm your EDR is in blocking mode and watches LSASS. Turn on Windows Credential Guard or LSA protection where supported, so memory dumping of login secrets fails even if malware runs.
- Stop saving business passwords in browsers. Move them to a managed password manager with MFA. Browser vaults are the first thing this class of malware grabs. See our guide to credential and identity theft.
- Remove local admin rights for everyday users. Several of the implant’s techniques work far better with admin rights, and the AI panel is explicitly told whether it has them.
- Decide whether Discord belongs on work devices. If there is no business need, restrict it. If there is, alert on webhook uploads from unusual processes.
- Watch for new persistence. Alert on new Run keys, scheduled tasks and WMI subscriptions, especially ones using Windows Update-style names.
- Keep a human check on AI-driven security verdicts. If an AI tool clears a suspicious file, make sure a rule-based control or a person can still flag it.
Frequently asked questions
What is autonomous AI malware?
It is malware that uses AI models to decide its own next steps after it lands on a computer, instead of waiting for commands from a human attacker. CLOSEDQUORUM, disclosed by Cisco Talos in September 2026, is the first publicly documented Windows implant that hands its command-and-control decisions to a panel of AI models.
Is CLOSEDQUORUM attacking businesses right now?
Talos has not confirmed any in-the-wild deployment, and the public copy is a non-working template. The concern is the design, which appears to be offered to other criminals as a service and could be adapted for other goals.
Should we block ChatGPT, Gemini or DeepSeek to be safe?
Blocking AI sites alone will not stop this kind of malware, and it tends to push staff toward unapproved workarounds. A better approach is to allow approved AI tools, flag unknown programs that call AI services, and rely on behavior-based endpoint detection for credential theft and injection.
Can antivirus catch it?
Talos has published file hashes and a YARA rule, so updated security tools can detect known builds. Custom builds for each buyer will vary, which is why behavior-based detection of LSASS access, process injection and new persistence matters more than signatures.
Get ready before the malware stops needing a driver
Delana Technologies helps Florida businesses tune endpoint detection for behavior-based threats, lock down credentials and admin rights, and inventory which applications are allowed to use AI, all within a Zero Trust architecture. If you are not sure your defenses would notice an implant that runs itself, call 239.414.5126 or contact us.
Sources: Cisco Talos, “The Closed Quorum: Inside the first reported autonomous AI C2 implant” and “Introducing CAIRN: Frontier tracking for AI-integrated malware,” both by Ryan Fetterman (22 September 2026); AI Weekly, AI News Today (23 September 2026).