Cisco Talos has published an analysis of a Windows implant that decides what to do next by polling four commercial AI providers and running whichever action wins the vote. The researchers call it CLOSEDQUORUM, and in their write-up published Tuesday they describe it as, to their knowledge, the first publicly documented Windows implant to use large language models for tactical command-and-control.
The binary is a 16.4MB, 64-bit executable compiled in Go with CGO enabled, which lets it mix in C and make direct Windows system calls. Once running, it needs no further instruction from a human and contacts no attacker-operated server.
Key takeaways
- CLOSEDQUORUM queries DeepSeek, Qwen, Mistral and Google Gemini in sequence, then executes the action that receives the most votes.
- Ties resolve deterministically in favour of DeepSeek, then Qwen, Mistral and Gemini β a bias that falls out of how the vote-counting loop is written.
- Talos found no evidence of in-the-wild deployment, and the publicly distributed build is inert, shipping with placeholder API keys and a dummy webhook.
How the vote actually works
A component Talos names the ModelOrchestrator queries each provider one at a time. The responses are collected and resolved into a single action by plurality vote: each model's decision increments a counter, and the highest count wins. Using four providers is partly about resilience β it raises the odds of getting a usable answer when one model refuses, times out, or returns malformed output.
The tie-break is an artefact of the implementation rather than a design statement. The loop that finds the maximum uses a strict comparison and walks the responses in submission order, so the first model to reach the winning count keeps it. DeepSeek is queried first, which makes it the deciding vote whenever the panel splits evenly. If every provider fails, the fallback value maps to no capability handler at all, and the implant simply sleeps and retries.
What the models are allowed to choose
The panel is not free to improvise. A system prompt extracted from the binary tells each model it is "an advanced malware strategist" and must provide only executable decisions, and responses are constrained to a typed JSON schema with four options: steal, inject, persist and move. Anything that fails to deserialise is discarded.
The options map straight to code. steal fires three routines at once β dumping LSASS memory for Windows credentials, pulling saved passwords from Chrome, Edge and Firefox, and extracting wallet data from MetaMask, Exodus and Ethereum. inject generates shellcode and then branches to either process hollowing or Early Bird APC injection. persist establishes a foothold on the host. move has no handler in the distribution build.
Before any of this, the implant gathers hostname, CPU count, OS architecture, Windows version and administrator status, and injects that context into every prompt. Results flow back to the operator through a Discord webhook, along with the model's stated reasoning and fields such as the targeted process and chosen evasion method.
Why Talos is framing this as effort displacement
The report's argument is that AI's effect on offensive operations has so far been measured in speed and scale, with the human operator still directing the work. Talos analyst Ryan Fetterman argues that handing an entire attack phase to a model changes the shape of the problem, since a system that does not sleep is not bound by an operator's attention or working hours.
Talos also draws a practical conclusion about infrastructure. Traditional command-and-control requires a domain and a listener that defenders can block, publish and track. Routing decisions through endpoints used by thousands of legitimate applications removes that handle. As The Register noted, Fetterman's recommended detection strategy is behavioural rather than domain-based: plenty of software talks to Gemini or Discord, but very little of it also reads LSASS or injects into suspended processes.
How real is the threat today
Less real than the architecture suggests, at least for now. Talos confirmed the decision loop through static analysis but never observed an end-to-end execution, because the public build initialises every credential to a dummy value. The team assesses that the developer compiles a bespoke binary for each buyer with that operator's keys and webhook baked in β a credentials-as-a-service model whose differentiator is the orchestration layer. Artifacts in the binary link the developer to carding forum postings going back to 2025.
Alongside the report, Talos released CAIRN, an open-source toolkit for hunting and classifying AI-integrated malware, and says CLOSEDQUORUM is the first of a series of findings from it. The pattern echoes earlier cases where attackers used agents to iterate malware past scanners β the difference being that here the model is not helping build the tool, it is operating it.
FAQ
Has CLOSEDQUORUM been seen in real attacks?
No. Cisco Talos says it has no confirmation of in-the-wild deployment, and the publicly distributed binary is a non-functional template with placeholder API keys and a dummy Discord webhook. The evidence for the autonomous loop comes from static analysis of the binary and from development builds.
Why does DeepSeek get the deciding vote?
It is a side effect of the code rather than a deliberate preference. The function that finds the winning decision uses a strict greater-than comparison while iterating responses in the order they were submitted, so the first model to reach the top count holds it. DeepSeek is queried first, followed by Qwen, Mistral and Gemini.
Can defenders block this by blocking AI provider domains?
Talos advises against relying on that. Legitimate software routinely contacts these providers, so blocking them is disruptive and incomplete. The recommended approach is to look for the combination of behaviours β AI API traffic from an unexpected executable, requests to several providers in quick succession, LSASS access or process injection, and Discord webhook traffic from the same host.
