CLOSEDQUORUM: Inside the First Reported Autonomous AI-Powered C2 Malware

Cisco Talos finds malware that turns AI models into a C2 decision layer

Artificial intelligence is increasingly being incorporated into cyber operations, but most documented uses have focused on helping human attackers work faster. Cisco Talos' analysis of a malware sample called CLOSEDQUORUM points to a different development: transferring part of the decision-making process itself from the attacker to AI models.

Talos describes CLOSEDQUORUM as the first publicly documented Windows implant, to its knowledge, to use this approach for tactical command and control (C2). Instead of relying on a traditional attacker-operated C2 server for every instruction, the implant queries commercial large language models (LLMs), aggregates their responses and executes the selected action.

Talos discovered the malware through its CAIRN project, an open-source research effort focused on tracking AI-integrated malware. Importantly, Talos has not confirmed that CLOSEDQUORUM has been deployed in the wild. Artifacts associated with the malware were, however, used to connect its developer to criminal-forum postings related to carding dating back to 2025.

The significance of CLOSEDQUORUM therefore lies less in evidence of a large-scale campaign and more in the architecture it demonstrates.

From AI-assisted attacks to AI-driven attack decisions

Talos separates the impact of AI on offensive cyber operations into three broad dimensions: speed, scale and effort displacement.

AI can already help attackers generate content, write code and automate portions of an intrusion. In those scenarios, a human operator generally remains responsible for deciding what happens next.

CLOSEDQUORUM introduces another model.

Here, a defined phase of the attack can be handed to an automated decision loop. The malware gathers information about the host, sends that context to several LLM providers, receives structured decisions and selects an action according to its voting mechanism.

This does not mean the malware is an unrestricted autonomous hacker. Its available actions are constrained by the capabilities implemented in the binary and by the decision schema expected from the models.

The distinction is important. The system is not giving an AI unlimited control over a computer. Instead, it reduces a particular decision space to a set of predefined actions and allows the models to select between them.

CLOSEDQUORUM uses multiple LLMs as its decision layer

The name CLOSEDQUORUM reflects the malware's architecture.

Talos found integrations for up to four LLM providers:

• DeepSeek

• Qwen

• Mistral

• Google Gemini

The models are queried sequentially. Their responses are collected and a plurality vote determines the selected action. If multiple providers are unavailable or fail to return usable results, the system has a fallback behaviour that causes the loop to retry rather than automatically selecting a default malicious action.

This architecture is notable because the LLM providers effectively become part of the malware's C2 infrastructure.

Traditional malware C2 commonly depends on attacker-controlled servers, domains, IP addresses or other dedicated infrastructure. CLOSEDQUORUM instead communicates with commercial AI services that also have legitimate uses.

That changes the defensive problem.

Blocking a known malicious C2 domain is comparatively straightforward. Blocking access to a mainstream AI provider can have significant operational consequences because legitimate software may use the same service.

The useful signal therefore becomes the combination of behaviours, rather than a single destination.

How the autonomous decision loop works

CLOSEDQUORUM collects host information during initialization, including information such as the hostname, Windows version, CPU count, system architecture and administrator status.

That information becomes part of the context supplied to the model decision process.

The LLM responses are not accepted as arbitrary text. Talos found a structured decision schema that limits the model to predefined options. The extracted system prompt instructs the model to provide executable decisions, while the returned response is deserialized into a structured Go object.

The decision field can route the malware toward capabilities associated with:

• Steal, which invokes credential and wallet collection functions

• Inject, which selects an implemented process-injection path

• Persist, which invokes persistence functionality

• Move, although Talos notes there is no corresponding handler in the distribution build

This constrained design is one of the most important characteristics of CLOSEDQUORUM.

The model does not need to invent an attack from scratch. Instead, it chooses from capabilities already implemented by the malware.

What the malware is designed to steal

Talos found several credential and cryptocurrency-wallet collection capabilities in CLOSEDQUORUM.

The implant can target:

• Windows credentials held in LSASS memory

• Saved credentials from Chrome, Edge and Firefox

• Cryptocurrency wallet information associated with MetaMask, Exodus and Ethereum wallet storage

Collected material is sent to an operator-controlled Discord webhook. Talos also found that the stolen material is encrypted before transmission.

These capabilities are not what makes CLOSEDQUORUM particularly unusual. Credential theft, process injection and persistence are established malware techniques.

The difference is the decision architecture surrounding those capabilities.

Instead of requiring an operator to continuously issue commands, the implant can ask its LLM panel which predefined capability should be executed next.

Deterministic voting gives the malware a predictable decision process

CLOSEDQUORUM's models do not simply provide four independent answers that are presented to a human.

The binary aggregates their decisions and selects the result with the highest number of votes.

Talos also identified deterministic tie-breaking behaviour. When there is a tie, the implementation favours the providers according to their order in the decision process, beginning with DeepSeek, followed by Qwen, Mistral and Gemini when those providers are available.

This illustrates an important principle in AI-integrated malware: the model does not operate independently of conventional software logic.

The surrounding malware determines what information reaches the model, what outputs are accepted and what happens after a decision is returned.

In other words, the AI is one component in a larger control architecture.

The public sample was not a fully operational deployment

Talos makes an important distinction between its technical findings and confirmed operational use.

The publicly distributed CLOSEDQUORUM binary contains placeholder LLM API credentials and a dummy Discord webhook. As a result, researchers did not observe a complete end-to-end execution of the architecture using the public sample.

Development builds provided additional evidence about how the malware could be configured. Talos assessed that customized builds may be generated with operator-specific LLM credentials and Discord webhook information embedded during compilation.

This means the report should not be interpreted as evidence that a fully operational autonomous malware campaign has already been observed at scale.

Instead, it documents an architecture that demonstrates how such automation can be implemented.

Why traditional C2 blocking may not be enough

Talos' defensive assessment focuses on behavioural correlation.

An enterprise application connecting to an AI provider is not inherently suspicious. The same applies to Discord traffic.

The situation becomes more unusual when an unexpected Windows executable simultaneously communicates with several AI providers while also demonstrating behaviours such as LSASS access, process injection, persistence creation and Discord webhook communication.

Talos therefore recommends looking beyond individual domains or services and examining the complete behaviour chain.

Potential signals include:

• AI-provider API traffic from an unexpected executable

• Connections to multiple AI providers within a short period

• Host-context or offensive capability prompts where such visibility is available

• Credential-access activity

• Process injection

• Persistence mechanisms

• Discord webhook communication

• Repeated execution at randomized intervals

Visibility into the actual prompt content may require TLS inspection or provider-side telemetry, so organisations should not assume that network monitoring alone will expose the complete decision process.

The defensive opportunity is behavioural correlation

The CLOSEDQUORUM case highlights an important challenge for security teams.

Individual components of the architecture can appear legitimate.

AI services are legitimate. Discord is legitimate. Windows processes can legitimately access sensitive resources under certain circumstances. Process injection and persistence, however, are established indicators of malicious activity.

The combination is more informative than any individual signal.

For defenders, this points toward stronger correlation between endpoint, identity and network telemetry. Security teams can investigate whether an executable that contacts AI services is also accessing credential stores, interacting with sensitive processes or establishing persistence.

This approach can also reduce dependence on simple blocklists when attackers use widely available commercial infrastructure.

AI autonomy also creates new failure points

Autonomy does not eliminate the weaknesses of the underlying technology.

Talos identifies several potential failure modes, including model refusals, rate limits, malformed responses, predictable voting behaviour, constrained action schemas and dependence on commercial APIs.

These limitations matter because CLOSEDQUORUM's autonomy depends on a chain of external services and internal decision rules.

If the models fail to provide an acceptable response, the malware cannot simply interpret any arbitrary output as an instruction. Its decision schema restricts what can be executed.

That creates opportunities for defenders to identify unusual AI-service interactions and correlate them with endpoint activity.

From speed and scale to effort displacement

The broader significance of CLOSEDQUORUM is the concept Talos calls effort displacement.

Earlier AI-enabled offensive techniques primarily helped attackers accomplish existing tasks more quickly or at greater scale.

An autonomous decision loop changes the relationship between the operator and the attack infrastructure.

A human no longer needs to remain continuously involved in every tactical decision within the automated phase. The malware can continue operating according to its predefined decision architecture and model responses.

This does not make the malware universally autonomous or capable of independently conducting every stage of an intrusion.

Instead, it demonstrates how a bounded portion of an attack chain can be transferred from human decision-making to an automated model-driven system.

What CLOSEDQUORUM means for cybersecurity

CLOSEDQUORUM represents an early example of a broader security issue: AI models can become components inside malware architectures rather than simply tools used by attackers.

That distinction matters for defenders.

Security teams have traditionally looked for malware communicating with attacker-controlled infrastructure. AI-integrated malware introduces another possibility: malicious software can use legitimate AI infrastructure as part of its operational decision process.

This does not make AI providers inherently malicious, nor does the Talos research establish that the providers knowingly participated in the malware's activity.

Instead, it demonstrates how attackers can attempt to repurpose ordinary commercial APIs as components of automated attack workflows.

For enterprises, the development highlights the growing importance of:

• Endpoint behavioural monitoring

• Correlation across network and endpoint telemetry

• Detection of unusual AI-service usage

• Monitoring sensitive credential-access activity

• Investigation of unexpected process injection

• Monitoring persistence mechanisms

• Understanding which applications are legitimately authorised to use external AI services

An early warning rather than evidence of widespread autonomous malware

The current evidence should be interpreted carefully.

Talos describes CLOSEDQUORUM as an early and limited example. The public sample was not configured for complete operation, and Talos has not confirmed deployment in the wild.

At the same time, the technical architecture demonstrates that commercially available AI models and ordinary API access can be incorporated into a malware decision loop.

That makes the research relevant even without evidence of widespread deployment.

The key change is architectural: malware can potentially shift from receiving every tactical instruction from a human operator toward making bounded decisions through model-driven logic.

As more attack phases become candidates for this kind of automation, security teams may need to detect not only malicious actions, but also the unusual combination of AI-service usage and endpoint behaviours surrounding those actions.

CLOSEDQUORUM provides defenders with a concrete example of what that emerging pattern can look like.