CLOSEDQUORUM: malware that asks four AI models what to do

Every piece of malware you have ever read about needed someone on the other end. A server to phone home to, an operator to type the next command, infrastructure a defender could find and take down. On September 22, Cisco Talos published CLOSEDQUORUM — what it calls the first reported autonomous AI command-and-control implant. It does not phone home. It asks four commercial AI models what to do next and takes the majority answer.

What actually happened

Talos researcher Ryan Fetterman analyzed a 16.4MB Windows executable that replaces the traditional C2 channel with a vote. The implant collects host information, packages it into a structured request, and sends it to as many as four model providers: DeepSeek, Qwen, Mistral and Google Gemini. The system prompt is not subtle — it tells the model it is "an advanced malware strategist" and to "Provide ONLY executable decisions."

The models pick from four constrained JSON options: steal, inject, persist, move. Highest count wins. Ties break in a fixed order — DeepSeek, then Qwen, then Mistral, then Gemini. If every provider fails to answer, the implant sleeps and retries.

Once it has a decision, the payload is conventional: LSASS memory, saved browser passwords in Chrome, Edge and Firefox, and cryptocurrency wallets including MetaMask, Exodus and Ethereum.

Two caveats matter, and Talos states both. There is no confirmed in-the-wild deployment. The sample carries non-functional placeholder API credentials, which suggests builds are customized per operator rather than shipped ready to run. Artifacts in the binary link the developer to carding forum postings dating to 2025, but Talos names no actor.

Alongside the writeup, Talos open-sourced CAIRN, a research toolkit for hunting and classifying AI-integrated malware.

Why autonomous AI malware matters for your business

The honest read: this specific sample is a proof of concept with placeholder keys in it. Nobody needs to panic-buy anything today. But the architecture is the news, and the architecture is cheap to copy.

Takedowns stop working the way you expect. The standard playbook against C2 is to find the domain or IP and kill it. You cannot null-route api.deepseek.com. The outbound traffic looks like every other API call your developers make all day, to hosts your allowlist probably already trusts.

Your egress allowlist is now a security control, not a formality. If you have ever waved through *.google.com or a model provider's domain because a tool needed it, that entry is now a viable exfil and command path. We audit these for clients and the answer is usually the same: nobody remembers who added the rule or why.

Domain allowlists were always the weak version. The stronger pattern is the one Google shipped in its Credentials API — proxy the egress, inject secrets at the edge, and reject anything that does not match a declared destination. Build agent infrastructure that way and the same controls happen to catch a process doing model calls it was never authorized to make.

Watch the shape, not the destination. A workstation making structured JSON calls to four different model providers in sequence is not a normal pattern for an accounting machine. That is a detection you can write today without buying anything.

The trend line is what Talos is pointing at: the operator is being removed from a bounded tactical phase. Same direction as the legitimate agent work everyone is shipping. It was never going to only run in one direction.

Sources: Cisco Talos, Google AI for Developers.