Talos's CLOSEDQUORUM lets four LLMs vote on an implant's next move, but the only public build is inert

One prompt, four votes, four possible words

The whole of CLOSEDQUORUM's "autonomy" fits in a list of four words: steal, inject, persist, move. Cisco Talos published research on 22 September 2026 describing a Windows implant that, after it lands, does not wait for an operator to tell it what to do. It gathers some facts about the host, writes one prompt, sends that prompt to as many as four commercial language model providers, counts their answers like votes, and runs whichever of those four words wins. Talos calls it "the first reported autonomous AI C2 implant".

That is a genuinely new place to put a language model, and it is worth understanding precisely. But the number that matters most in the report is smaller than the headline. The action space the model gets to reason over is four items wide, and one of those four (move) has no code behind it in the build Talos could examine. So the model is not writing the attack. It is choosing, from a menu the human author fixed in advance, which pre-written capability fires next. Everything the winning word triggers, the LSASS dump, the injection routine, the persistence, the theft, was compiled into the binary by a person.

What the report does not establish

Before the mechanics, the limits, because they change how you should read this. Talos is explicit that it has no confirmation the implant was ever deployed against a victim. The sample that circulates publicly is inert: every language model API key initialises to dummy_api_key and the Discord webhook initialises to dummy_webhook_url. Talos states plainly that the binary is "non-functional as distributed" and that it "did not observe a complete end-to-end execution of the architecture".

So the voting loop is real in the sense that static analysis of the code confirms it, and development builds show provider credentials being injected at compile time. It is not real in the sense that anyone has watched it run a full cycle, or seen it steal anything from anyone. Those are different claims, and the report keeps them apart. This briefing does too.

What the Talos report establishes versus what it does not (from the Closed Quorum and CAIRN posts)

What it establishes	What it does not establish
The binary contains a working multi-model voting loop, confirmed by static analysis and unstripped Go function names	That the loop has ever completed a full run against a real target
Development builds injected real provider keys at compile time	That any operator deployed a configured build in the wild
The developer's artefacts link to carding-forum postings dating to 2025	The developer's identity, location, or that they ran attacks themselves
Four action words route to four handlers, one of which is empty	That the model can do anything outside those four fixed choices

How the decision loop works

CLOSEDQUORUM is a 16.4MB, 64-bit Windows executable written in Go, with some C mixed in so it can make direct Windows system calls. The design choice Talos highlights is the treatment of the model providers as the command and control channel. A traditional implant phones home to a server the attacker runs: a domain, an IP, a listener. That infrastructure is attributable, blockable, and shows up in threat feeds and certificate logs. CLOSEDQUORUM instead calls endpoints that thousands of legitimate applications hit every day.

The cycle runs like this. A routine captures host context: hostname, operating system, architecture, CPU count, Windows version and admin status. That becomes a TARGET string dropped into a prompt template. The system prompt, lifted from the binary, reads: "You are an advanced malware strategist. Provide ONLY executable decisions." The template then enumerates the model's choices and demands a typed JSON reply with six fields: a decision (one of the four words), reasoning, a target_process, an exploit_type, an evasion_method and a payload_config.

An orchestrator queries the providers one by one. Each reply is deserialised into a Go struct, and the decision field of each is counted in a map. The word with the most votes wins and is routed to a handler. If the models disagree three ways, plurality still resolves it. If they all fail, whether through refusal, timeout or malformed output, the fallback is a word with no matching handler, so the loop simply sleeps and retries rather than defaulting to an action. Talos frames the four-provider design as resilience: it raises the chance of getting a usable decision even when one model refuses on a guardrail, but it does not guarantee one.

Which decisions the model actually makes

This is the crux, and the friendly-name fallacy to attack. "Autonomous AI C2" invites you to picture a model authoring exploits and improvising. That is not what the evidence shows. The model chooses among four fixed words and fills in a few parameters. The capabilities themselves are ordinary, hand-written implant code. It is worth separating what the model decides from what the author already decided.

Model decision versus hard-coded logic in CLOSEDQUORUM (from the Closed Quorum report)

The model decides	The author hard-coded
Which of steal, inject, persist or move happens next	The four words and every capability they trigger
Parameters such as target process, exploit type and evasion method	That inject defaults to Early Bird APC, or process hollowing on request
The stated reasoning attached to a decision	How votes are counted and how ties resolve
Nothing when all providers fail: the loop just sleeps	The LSASS dump, browser and wallet theft, persistence and exfil

The tie-break deserves a note because it undercuts the word "quorum". A quorum implies a deliberative body. Here the vote count iterates the replies in submission order using a strict "less than" comparison, which means the first model to reach the top count keeps it. DeepSeek is queried first, so DeepSeek wins every tie; if it is absent, Qwen inherits the casting vote, then Mistral, then Gemini. Talos describes the behaviour as "fully deterministic and biased toward DeepSeek". A defender can predict the outcome of a split without ever seeing the models' replies.

What the four actions do

The interesting part of CLOSEDQUORUM is the decision layer, not the payloads, which are familiar. steal runs three routines together: an LSASS memory dump via MiniDumpWriteDump after enabling debug privilege, theft of saved browser logins from Chrome, Edge and Firefox, and extraction of cryptocurrency wallet data for MetaMask, Exodus and Ethereum. inject generates shellcode and, by default, uses an Early Bird asynchronous procedure call routine into a suspended process; when the model returns process_hollow it uses process hollowing instead. persist establishes itself through a registry Run key, a scheduled task, or a WMI event subscription that fires roughly every 60 seconds. move, the lateral-movement word, has no handler in the public build at all.

Collected material is staged under a Windows temporary directory, encrypted with AES-256-GCM using a key derived from the current date, Base64 encoded, split into 1,900-byte segments and posted to an operator Discord webhook at one-second intervals. The same webhook doubles as live telemetry: it receives the winning action, the model's reasoning and the parameters in real time. The implant also suppresses ETW telemetry by overwriting a logging function with a single return instruction, waits five minutes on start, and then polls at randomised 5 to 15 minute intervals to stay under short sandbox timeouts.

The encryption is worth reading carefully, because it reveals the business model. The key is symmetric and derived from the date, not an asymmetric key unique to the operator. That means the developer, who always knows the date, could in principle decrypt any operator's stolen data. Talos calls this "obfuscation, not true confidentiality separation between developer and operator". Each operator still gets a distinct build and a distinct Discord channel.

The operating model, and the commercial interest to note

Talos assesses that CLOSEDQUORUM is sold as a service rather than run by its author. The reasoning: the public sample is an inert template, and development builds show the developer compiling a custom binary for each operator with that operator's webhook and provider keys baked in. The inferred model is credentials-as-a-service, where the differentiator is the autonomous model-orchestration layer. An operator who buys it does not need to stay online; they deploy the build and the voting loop runs the harvesting phase. The link to the developer runs through artefacts that Talos ties to carding-forum postings dating to 2025. Identity, and whether any operator ever fielded it, remain open.

Method should be separated from accusation, and there is a commercial interest to state plainly without sneering. CLOSEDQUORUM surfaced through CAIRN, Talos's own open-source hunting toolkit, released the same day. Talos is a division of Cisco, which sells the detection and network security products that address exactly this class of threat. The Snort rule for the family, 1:66984, is a Cisco product; its documentation even labels the usage as "Attacks/Scans seen in the wild", a firmer phrasing than the blog's own "we do not have confirmation of in-the-wild deployment". That gap between a marketing-facing rule field and the research post's careful hedging is the kind of thing to weigh when a vendor both finds and sells the fix. None of that makes the analysis wrong. It does mean a defender should lean on the technical detail, which is verifiable, rather than the framing.

Testing the "first reported" claim

Talos is careful about its own "first": the precise claim is the first publicly documented Windows implant to apply model-driven decisions to tactical command and control. That is narrower than "first AI malware", and the narrowing is load-bearing, because malware that queries a language model at runtime is over a year old by September 2026. Checking the claim against primary sources shows what is new and what is not.

Earlier public cases of malware using a language model at runtime (from CERT-UA, GTIG, ESET, SentinelLABS and Anthropic primary sources)

Case and source	What the model did	In the wild?
MalTerminal (SentinelLABS, Sep 2025)	Called GPT-4 to generate ransomware or a reverse shell; endpoint deprecated Nov 2023, so likely the earliest known	No, no deployment reported
LameHug / PROMPTSTEAL (CERT-UA, Jul 2025)	Queried Qwen2.5-Coder-32B via Hugging Face to generate recon commands	Yes, used against Ukrainian bodies, tied to APT28 with moderate confidence
PromptLock (ESET, Aug 2025)	Used a local gpt-oss-20b model via Ollama to write Lua for its ransomware	No, later confirmed an academic prototype
PROMPTFLUX (GTIG, Nov 2025)	Called Gemini to rewrite its own source hourly for evasion	No, assessed as in development
PromptSpy (ESET, Feb 2026)	Fed the screen to Gemini and acted on returned tap and swipe coordinates on Android	No, assessed a likely proof of concept

So the model-in-the-loop is not new. LameHug, which CERT-UA logged in July 2025 and linked to APT28 with moderate confidence, is the clearest in-the-wild case, and it used Qwen through Hugging Face to generate the commands it then ran. What is different about CLOSEDQUORUM is the shape of the delegation. LameHug and PROMPTFLUX ask a model to write code or commands. CLOSEDQUORUM asks a panel of models to choose a tactic from a fixed menu and pools their answers by vote. That specific pattern, several commercial providers as a redundant decision quorum for tactical C2 on Windows, is what Talos is claiming as a first, and against these sources that narrower claim holds. The broader impression that this is the debut of AI-driven malware does not.

The most relevant contrast is with operator-side autonomy, which is further along than any single implant. Anthropic's November 2025 report described a suspected Chinese state group (tracked as GTG-1002) driving Claude Code to run 80 to 90 per cent of an espionage campaign against roughly thirty targets, with humans stepping in at only a handful of decision points; Anthropic called it the first documented large-scale cyberattack executed without substantial human intervention. Its September 2026 report then described a Russia-linked actor, GTG-20006, whose agents autonomously rebuilt malware whenever a security product flagged it. Talos's own August 2026 UAT-10147 report showed a Chinese-speaking crew using agentic tooling to automate a ViewState exploitation chain end to end. Those operations put the model in the attacker's console. CLOSEDQUORUM is the mirror image: it bakes a shrunken slice of that decision-making into the implant itself, on the victim machine, where it can run with the operator offline. Our earlier briefing, Anthropic report: Russia-linked AI malware evasion loop, covers the console-side version of the same trend.

What defenders can actually detect

The good news is that moving C2 to commercial model endpoints trades one set of weaknesses for another. Domain blocking is a poor fit, because DeepSeek, Mistral, Gemini and Discord are all contacted by legitimate software. But the combination is distinctive. Very little benign software calls several model providers in quick succession from the same process that is also reading LSASS, injecting into a suspended process, or creating a WMI persistence subscription. The prompt content itself would be a strong signal, but Talos notes it is usually only visible with TLS inspection or provider-side telemetry, so most defenders will be reasoning from behaviour and egress patterns, not prompt text.

The autonomy also imports fragilities a defender can exploit. The implant depends on third-party APIs that rate-limit, refuse, and can be cut off. The tie-break is predictable. The action schema is tiny. Provider-side abuse teams can revoke keys. And because LLM-enabled malware must carry its prompts and its means of access, those artefacts, as SentinelLABS showed by hunting on embedded keys and prompt structures, are exactly what hunting can pivot on. Autonomy did not make this implant robust; it swapped human limits for model and infrastructure limits.

The question that exposes the gap

CLOSEDQUORUM is best read as a demonstration, not a campaign. Talos itself says it is "not a sophisticated piece of malware" but a sign that attack-chain automation is coming, and that defenders have "an open window" while the trend is early. The concrete precedent it sets is small and specific: tactical attack logic encoded as model-readable context, and structured model output turned straight into execution. That is enough to matter, and modest enough to keep in proportion.

The framing to resist is the one the name invites. A vote among four models is not a mind; it is a switch statement with an API bill. The real question for a security lead is not whether the malware can "think". It is this: if an implant on one of your endpoints started talking to four language model providers and then dumped LSASS, would anything you run notice the conversation, or only the theft? The theft you can already catch. The conversation is the new signal, and it is the one most monitoring is not yet watching for.

Key facts