Cisco Talos has published research on CLOSEDQUORUM, a Windows implant that demonstrates a new direction for AI-enabled malware: using commercial large language model APIs as part of the command-and-control decision loop.

Talos says it has not confirmed in-the-wild deployment, and the public distribution build it analyzed used placeholder API keys and a dummy webhook. Even so, the architecture matters. CLOSEDQUORUM shows how an attacker can encode a bounded set of malicious choices, ask multiple models to vote on the next action, and then execute the winning decision without waiting for live operator tasking.

Original research: Cisco Talos — The Closed Quorum: Inside the first reported autonomous AI C2 implant.

What Talos found

CLOSEDQUORUM is described as a 64-bit Windows executable written in Go. The implant contains conventional offensive capabilities — credential theft, browser password collection, crypto wallet targeting, process injection, persistence, and Discord webhook exfiltration — but the important part is how it chooses what to do next.

Instead of receiving operator commands from a traditional attacker-controlled C2 server, the implant can query a panel of LLM providers. Talos reported provider integrations for DeepSeek, Qwen, Mistral, and Google Gemini. Each model is asked for a structured JSON decision, the implant tallies the results, and the highest-voted action is routed into a local capability handler.

That turns the LLM layer into a tactical decision engine. The models are not inventing arbitrary malware from scratch at runtime. They are choosing among attacker-defined options such as stealing credentials, injecting into a process, establishing persistence, or moving through the environment.

Why this matters

The practical risk is not that every intrusion suddenly becomes fully autonomous. The practical risk is that attackers are starting to remove human operators from specific phases of the intrusion chain.

That changes the defender’s timing problem. A human-operated intrusion often has pauses: waiting for tasking, waiting for an operator to review output, waiting for the next shift. An implant that can make constrained decisions locally can continue cycling through actions while the operator is offline. Even if the first generation is brittle, noisy, or dependent on commercial APIs, the pattern is worth taking seriously now.

It also makes traditional C2 blocking less complete. If malicious logic is riding over API calls to widely used AI providers and reporting through commodity services like Discord webhooks, defenders cannot rely on domain reputation alone. Blocking every AI provider or collaboration platform is not realistic for many organizations.

Defensive takeaways for SMBs and government contractors

  • Baseline AI-provider API traffic. Know which applications and users should be talking to model providers. Unexpected LLM API calls from random Windows executables should be treated as suspicious, especially when paired with credential access behavior.
  • Correlate API traffic with endpoint behavior. The signal is not “a host contacted an AI provider.” The signal is “an unusual binary contacted multiple AI/model APIs, touched LSASS, staged browser databases, injected into processes, or created persistence.”
  • Watch webhook destinations. Discord webhooks, Slack webhooks, and similar services are legitimate in many environments, but they are also convenient exfiltration channels. Restrict and monitor webhook usage from servers, admin workstations, and high-trust endpoints.
  • Harden credential stores. Browser password stores, local wallet files, LSASS memory, and developer secrets remain high-value targets. Prioritize EDR controls, LSASS protection, admin tiering, and password-manager governance.
  • Inspect persistence creation. Talos mapped CLOSEDQUORUM behaviors to Registry Run keys, scheduled tasks, and WMI event subscriptions. Those are still bread-and-butter detections that matter even when the decision layer changes.
  • Do not ignore “proof-of-concept” malware architecture. Even if a public sample is not operational, its design can preview what criminal tooling will normalize next.

What to hunt for

Defenders should build detections around combinations of activity rather than single indicators:

  • Non-browser Windows executables making outbound requests to multiple AI/model-provider APIs in a short window.
  • AI-provider traffic followed by LSASS access, browser credential database access, crypto wallet file discovery, or suspicious staging under temporary directories.
  • Discord webhook posts from endpoints that do not have a business reason to use Discord automation.
  • Process injection patterns such as suspended process creation, memory writes into another process, APC queuing, or process hollowing.
  • New scheduled tasks, Registry Run keys, or WMI event subscriptions created by untrusted executables.

Bulwark Black assessment

CLOSEDQUORUM should be treated as an early warning signal, not a panic button. Talos is careful about the limits of what it observed: the public build was not fully operational, and confirmed deployment has not been reported. But the architecture is the story.

AI-enabled malware does not need to be magic to be dangerous. It only needs to reduce the amount of operator attention required to run a campaign. CLOSEDQUORUM shows one way to do that: constrain the model’s choices, provide local host context, use plurality voting, and convert the winning answer into execution.

For smaller businesses and government contractors, the answer is not to chase every AI headline. The answer is to improve the controls that survive architectural change: least privilege, credential protection, application control, egress monitoring, webhook restrictions, endpoint telemetry, and response playbooks that connect network anomalies to host behavior.

The best time to build those correlations is before autonomous C2 patterns become common.