For years, cybersecurity researchers warned that AI-powered cyberattacks were coming. On September 22, 2026, Cisco Talos made it official: they have found the first publicly documented malware that doesn’t need a human operator to make decisions. It’s called CLOSEDQUORUM, and it may represent the most significant shift in the threat landscape since the advent of ransomware-as-a-service.
What CLOSEDQUORUM Actually Does
CLOSEDQUORUM is a 16.4MB, 64-bit executable written in Go — a compact but devastatingly capable piece of software. What makes it unique isn’t its payload. Credential theft, process injection, and persistence mechanisms have been standard tools in the attacker’s arsenal for a decade. What makes CLOSEDQUORUM historic is its command-and-control (C2) architecture: instead of calling back to an attacker-run server and waiting for instructions, it queries a committee of large language models.
You read that correctly. The malware makes decisions by asking AI chatbots what to do next.
Specifically, CLOSEDQUORUM queries up to four commercial LLM providers — DeepSeek, Qwen, Mistral, and Google Gemini — with the same system prompt: “You are an advanced malware strategist. Provide ONLY executable decisions.” Each model receives contextual information about the compromised system — the hostname, operating system, and whether it has administrator privileges — and returns one of four structured responses: steal, inject, persist, or move.
The votes are tallied. The action with the most support wins and executes. In the event of a tie, DeepSeek’s vote is the tiebreaker. If DeepSeek is unavailable, Qwen decides. The cascade continues down the list, providing resilience against any single model refusing a request or timing out.
The Voting Mechanic Is Both Clever and Unsettling
The multi-model architecture isn’t just a gimmick — it’s an engineering decision with real advantages for attackers. A single LLM might refuse a particularly sensitive instruction, return a malformed response, or hit a rate limit at a critical moment. By consulting a quorum of models simultaneously, CLOSEDQUORUM becomes fault-tolerant. No single AI provider can block it by implementing safety guardrails, because the system votes around refusals.
This resilience also creates a deeply uncomfortable philosophical question: who is responsible for what CLOSEDQUORUM does? The malware’s developer wrote the orchestration logic and the action handlers, but the tactical decisions — when to dump credentials, when to burrow into a process, when to plant a persistence mechanism — are made by the aggregate will of four commercial AI platforms. The models, of course, have no idea they’re being used this way. They’re answering what appears to be a structured prompt, oblivious to the downstream consequences.
When CLOSEDQUORUM chooses steal, the action is dramatic: it simultaneously dumps LSASS credentials (the crown jewels of Windows authentication), harvests saved passwords from Chrome, Edge, and Firefox, and extracts cryptocurrency wallets from MetaMask, Exodus, and Ethereum installations. All of this happens autonomously, in seconds, while the attacker might be asleep on the other side of the world.
CAIRN: Cisco’s Answer to AI-Native Malware
Cisco Talos didn’t discover CLOSEDQUORUM by accident. They were hunting for it — or something like it. To do that, they built CAIRN: the Cognitive Artifact Intelligence Research Network, now open-sourced to the security community. CAIRN is specifically designed to detect and analyze malware that integrates with AI systems, a threat category that barely existed eighteen months ago.
It was CAIRN’s analysis of development builds that revealed CLOSEDQUORUM’s inner workings. Talos found six distinct build hashes spanning seven days of iterative development, giving researchers a rare window into the author’s engineering process. The builds showed a malware-as-a-service (MaaS) architecture taking shape: public distribution builds contain only placeholder API keys, meaning operators buy the malware and plug in their own commercial AI API credentials. The developer sets the strategy; the buyer brings the LLMs.
Artifacts from those builds also linked the developer to criminal forum postings about carding dating back to 2025 — suggesting this isn’t an improvised hack by an AI enthusiast, but a deliberate evolution by an experienced threat actor who recognized that the intelligence arms race had reached a tipping point.
Why This Changes Everything — and Why Defenders Still Have a Window
The traditional cybersecurity response to C2 infrastructure is to map it, block it, and take it down. If an attacker’s server goes offline, their malware goes dark. CLOSEDQUORUM inverts this entirely. Its C2 is distributed across multiple commercial API endpoints — DeepSeek’s servers, Mistral’s API, Google’s infrastructure. You cannot “take down” the AI providers that CLOSEDQUORUM relies on. They’re public utilities at this point.
This is not just a technical escalation; it’s a doctrinal one. CLOSEDQUORUM represents the automation of judgment, not just execution. Previous automated malware moved fast once a human operator gave the go-ahead. CLOSEDQUORUM eliminates the go-ahead. It decides for itself.
But Cisco Talos researchers are careful to note that this autonomy also creates new defensive opportunities. Commercial AI providers impose rate limits, have content policies that occasionally trigger refusals, and require structured outputs that can be detected in network traffic. The same architectural constraints that make CLOSEDQUORUM resilient also make it legible in ways that a pure human-operated attacker is not.
Multi-provider API queries within short timeframes are a new behavioral signature. The combination of LSASS access, process injection, WMI persistence enrollment, and Discord webhook exfiltration — all orchestrated autonomously — creates a behavioral cluster that traditional SIEM rules weren’t built to catch, but can be built now that the pattern is documented. CAIRN’s open-source release is Cisco’s contribution to that effort: a framework for the security community to build detections before CLOSEDQUORUM and its successors become ubiquitous.
The Broader Threat Landscape
CLOSEDQUORUM did not arrive in a vacuum. The 2026 threat landscape has been building toward this moment for years. In July, researchers documented JadePuffer, the first AI-orchestrated ransomware strain. In August, the HalluSquatting report detailed botnets exploiting AI hallucinations to register lookalike domains. The CLOSEDQUORUM disclosure is the third major inflection point in the AI threat curve in as many months.
What distinguishes CLOSEDQUORUM is its elegance. JadePuffer used AI to generate ransom notes and negotiation scripts — the human attacker was still driving. CLOSEDQUORUM removes the human from tactical operations entirely. The attacker’s job is now to deploy the implant and collect the proceeds. The malware handles the rest.
“This progression is still only beginning,” Cisco Talos wrote in their disclosure. “We have an open window to study this transition.”
That window is closing. The CLOSEDQUORUM builds Talos analyzed predate widespread deployment — this is a research disclosure, not an incident response post-mortem. For now, the security community has something rare in cybersecurity: advance notice.
The question is whether defenders can build the detections, update the playbooks, and pressure AI providers to implement better API abuse detection before that advantage disappears.
What Organizations Should Do Right Now
The CAIRN framework is open-source and available for security teams to deploy today. Talos recommends monitoring for multi-LLM API call patterns in network egress traffic, behavioral clustering rules that combine credential access with process injection sequences, and ETW telemetry gaps that may indicate suppression activity.
More broadly, CLOSEDQUORUM is a reminder that the AI security conversation cannot remain abstract. Every AI API key your organization issues is a potential asset for an attacker who finds it. Rate limits, access controls, and anomaly detection on AI API usage are now security fundamentals, not nice-to-haves.
The era of AI-autonomous malware has arrived. CLOSEDQUORUM is version one.
Sources: Cisco Talos Intelligence Blog, BleepingComputer, Help Net Security, AI Weekly
