CLOSEDQUORUM Runs Its Own Attack Without Asking Anyone
Cisco Talos has identified what it calls the first fully autonomous command-and-control implant: malware that polls a panel of AI models to decide its next move and never checks back with its operator.
Key points
- Cisco Talos published details of CLOSEDQUORUM, calling it the first reported malware to use an AI panel as its own command-and-control system.
- The malware targets saved passwords in Chrome and Firefox, Windows login credentials stored in memory, and cryptocurrency wallets including MetaMask and Exodus.
- Four AI models vote on each attack step; no human operator needs to be online once the binary is running.
- Cisco Talos simultaneously released CAIRN (Cognitive Artifact Intelligence Research Network), an open-source toolkit it has used to hunt AI-integrated malware since July 2025.
- Talos found no confirmed real-world victims, but linked the developer to criminal carding forums active since 2025 through artifacts embedded in the binary.
Some malware sits waiting for instructions. CLOSEDQUORUM doesn't wait for anyone.
Cisco Talos published a detailed breakdown of a Windows executable they're calling the first known example of fully autonomous command-and-control, or C2: the system an attacker normally uses to send live instructions to malware already running on a victim's machine. CLOSEDQUORUM replaces that human-operated system entirely with a panel of four commercial AI models.
Once deployed, the malware queries each model in turn. The models vote, the majority verdict is executed, and no operator is required.
How does the attack actually work?
The malware queries DeepSeek, Qwen, Mistral, and Gemini in sequence, feeding each a system prompt that begins: "You are an advanced malware strategist. Provide ONLY executable decisions." Each model must reply in a rigid, structured format; anything else is discarded. The winning verdict is automatically converted into an action on the victim's machine.
The targets are specific. CLOSEDQUORUM dumps credentials from Windows' LSASS process, the part of Windows that handles logins and enforces security policies, pulling usernames and passwords from memory. It also raids saved passwords stored by Chrome and Firefox and hunts for cryptocurrency wallet files from MetaMask and Exodus.
On a tie, the malware breaks the deadlock in a fixed order: DeepSeek first, then Qwen and Mistral, with Gemini last. Should every model fail or refuse, the loop simply sleeps and retries rather than defaulting to action.
"It does not go offline when the attacker sleeps," Talos researcher Ryan Fetterman wrote in the advisory.
Should ordinary people be worried right now?
Talos has found no confirmed victims. The concern is structural, not immediate. The binary is a working proof of concept, and artifacts inside it connected its developer to carding forums, online criminal marketplaces for stolen payment card data, active since 2025.
What changes here is the business model. Fetterman describes CLOSEDQUORUM as a "credentials-as-a-service" design: a criminal buys or rents the binary, deploys it, and walks away. The AI panel runs the campaign, which means low-skill buyers can run high-skill attacks.
The malware does have real weaknesses. Commercial AI providers can refuse requests. Models can produce malformed output. Dependence on external API calls, meaning internet requests to the AI companies' servers, creates detectable network traffic. Talos notes that defenders should watch for AI-provider traffic coming from unexpected Windows programs, structured prompts appearing in network logs, and a process pinging out at randomised five-to-fifteen-minute intervals.
Our 26 August story on AI malware found that of 405 samples linked to AI tools studied by Palo Alto Networks, only 12 ever reached a real computer and existing defences caught every one. CLOSEDQUORUM is a different architecture, but that baseline is worth keeping in mind.
How did Talos find it?
The discovery came through CAIRN (Cognitive Artifact Intelligence Research Network), an open-source research toolkit Talos released alongside the advisory. CAIRN works by treating the traces AI integration leaves inside a binary, things like API keys, prompt text, and provider endpoint addresses, as searchable metadata. Talos has run CAIRN since July 2025 and has built graphs connecting malware samples by those shared artifacts, without needing to execute the malicious code.
The toolkit sends samples to VirusTotal, a service that scans files against dozens of security products, and applies twelve filters to surface AI-related strings. The result is a map of related malware families and infrastructure that defenders can use to spot variants before they spread.
Fetterman's bluntest observation is also the most useful: the progression from "LLM as optional feature" to fully autonomous multi-model attack orchestrator filled in within a single calendar year. That's worth taking seriously regardless of whether CLOSEDQUORUM itself ever reaches a real target.
What should you do if you manage Windows systems?
Block or alert on outbound API calls to commercial AI providers originating from executables outside your approved software list. Review process network logs for repeated, randomised-interval calls to those endpoints. Credential-dumping from LSASS is already flagged by most endpoint detection tools; make sure those alerts aren't suppressed. Enforce multi-factor authentication, which requires a second proof of identity beyond a password, on all accounts, so stolen passwords alone can't break in.
