CLOSEDQUORUM: AI Models Vote on the Next Move

CLOSEDQUORUM Lets Up to Four AI Models Decide What It Does

Every Windows trojan has the same silhouette: it phones home to a command-and-control server the attacker runs, and a human operator decides what happens next. Cisco Talos published a piece on September 22, 2026 describing an implant built to skip that server — and the operator — entirely. CLOSEDQUORUM asks up to four commercial AI models what it should do, tallies their votes, and acts on the result.

Talos found the binary with CAIRN (Cognitive Artifact Intelligence Research Network), an open-source metadata-hunting toolkit released the same day for tracking malware that operationalizes AI. To Talos's knowledge it is the first publicly documented Windows implant to hand its tactical C2 decisions to an LLM panel.

The quorum: four providers, zero humans

CLOSEDQUORUM is a 16.4 MB 64-bit Windows executable compiled in Go. After deployment it stops waiting for instructions. A ModelOrchestrator queries up to four LLM providers in sequence — DeepSeek, Qwen, Mistral and Google Gemini — feeding each one host context and a fixed menu of actions. The responses are collected as a slice of decisions and resolved by interModelDiscussion().

The models do not get free rein. Each reply must deserialize into a typed JSON schema — the system prompt, extracted from the binary, reads "You are an advanced malware strategist. Provide ONLY executable decisions." A response that does not map onto a known action is discarded. A simplified view of the aggregation:

type LLMDecision struct {
    Decision  string // "steal" | "inject" | "persist" | "move"
    Reasoning string
}

// one vote per provider; highest count wins
votes := map[string]int{}
for _, d := range decisions {
    votes[d.Decision]++
}
winner := ""
for _, d := range decisions { // first maximum wins — deterministic tie-break
    if votes[d.Decision] > votes[winner] { winner = d.Decision }
}

If no model returns a usable answer, the loop falls back to a consensus string that has no capability handler — in other words, it sleeps and retries instead of picking a default action. This is the two-player design of the whole project: aggregate models to dodge individual refusals, rate limits and guardrails, but never act on a signal you cannot trust structurally.

Ties are resolved with a fixed order of preference: DeepSeek, then Qwen, then Mistral, then Gemini. The max-finding loop iterates in submission order, so the first-encountered maximum wins. DeepSeek holds the deciding vote whenever it is in the quorum.

What the models get to choose

Before each cycle, gatherSystemInfo() captures hostname, OS architecture, CPU count, Windows version and admin status as the TARGET: context injected into every prompt. Four capabilities sit behind the vote:

• steal — runs three things at once: dumps LSASS memory (Windows login credentials), copies saved passwords from Chrome, Edge and Firefox, and pulls MetaMask, Exodus and Ethereum wallet data.
• inject — generates shellcode and starts a suspended process. The default is Early Bird APC injection; if the model picks process_hollow, it uses process hollowing instead.
• persist — three mechanisms at once: a value under the current user's Registry Run key, a scheduled task, and a permanent WMI event subscription that restarts the payload every 60 seconds. The Registry and WMI names are themed on Windows Update so they blend into normal system activity.
• move — has no code behind it in the public build. Picking it does nothing.

Stolen material is AES-256-GCM encrypted with a key derived from the current date, split into 1,900-byte pieces, and posted one piece per second to a Discord channel via a webhook. The model's chosen action and its stated reasoning go to the same channel — the operator watches the AI's decisions live.

An inert build, an operating model

Talos has not seen CLOSEDQUORUM work from start to finish, and the public distribution build is non-functional: all API keys initialize to dummy_api_key and the webhook to dummy_webhook_url, so it can neither reach the models nor exfiltrate anything.

What the development builds show is the intended operating model: the developer produces a customized executable per operator, injecting that operator's Discord webhook and LLM API keys at compile time. The operator hands out the binary and does not need to stay online — the LLM panel runs the campaign. Talos describes it as a credentials-as-a-service model where the differentiator is the autonomous AI orchestration layer. Static analysis is dated June 17, 2026, making the code at least three months old, and code clues tie the developer to criminal-forum posts about carding dating back to 2025. There is no confirmed in-the-wild deployment.

What the AI actually changes

AI-assisted malware is not new — Ukraine's CERT-UA reported LAMEHUG in July 2025 asking a model to write commands for tasks set in its code. CLOSEDQUORUM moves up a level: the model does not write the instructions within a preset task list, it chooses the task. Rather than a single attacker-operated C2 server — a domain, IP, protocol and listener that is attributable, blockable and expensive to rotate — the implant dials up to four commercial LLM endpoints used by thousands of legitimate applications daily. Talos calls the shift effort displacement: an entire phase of the attack is transferred from a human operator to the system, and the intrusive operation no longer needs the attacker to be awake or connected.

The same design creates its weak points. Providers can refuse requests, cap how many they answer, or return malformed output. The decision schema is deliberately small. The tie-break is predictable. And the whole implant depends on commercial API access the developer does not control. Autonomy trades human limitations for model and infrastructure limitations — which is exactly where defenders should be looking.

How to catch it

Talos's detection guidance is behavioral, not domain-based. Blocking api.deepseek.com or Discord is pointless — legitimate software talks to all of them. Watch instead for the combination:

• AI-provider API traffic from a Windows executable that has no business using AI
• Similar requests to several AI providers within a short window
• LSASS access, process injection, or new persistence alongside that traffic
• Discord webhook traffic from the same process or host
• Activity recurring at random 5–15 minute intervals

Talos published a Snort rule (1:66984) that matches the implant's prompts — though those prompts are only visible under TLS inspection, so the rule likely needs decrypted traffic to fire — plus a YARA rule and six SHA-256 hashes from seven days of the developer's build chain. CAIRN itself is designed so analysts and agent workflows can hunt for LLM endpoints, tool-call syntax and evasion strings in metadata without ever downloading samples — but every finding still needs manual reverse engineering to confirm.

This is, as Talos puts it, an early and limited example. It is also a concrete demonstration that removing the operator from a bounded phase of an intrusion is achievable with today's models and ordinary API access. The same scaffolding — encode a decision space, feed it to a model panel, convert structured output straight into execution — translates directly to other adversary objectives, so the window to build behavioral detection is open right now. It has been three months; it is not going to stay open forever. For more on how AI is creeping into attack chains, see the RatHat Android malware using AI for device control.

Sources

• Cisco Talos: The Closed Quorum: Inside the first reported autonomous AI C2 implant
• Cisco Talos: Introducing CAIRN: Frontier tracking for AI-integrated malware
• The Hacker News: This Windows Malware is Built to Let Up to Four AI Models Vote on Its Next Move
• Cisco Talos: Cisco-Talos/Cognitive-Artifact-Intelligence-Research-Network
• Cisco Talos: Snort rule 1-66984 — CLOSEDQUORUM