The first malware that takes orders from AI

For years, AI has made human hackers faster. A new piece of malware just showed it can replace them entirely.

On September 22, 2026 at 06:00 (UTC-4), Cisco Talos published a detailed analysis of CLOSEDQUORUM — a 16.4-megabyte Windows implant that, to the researchers' knowledge, is the first publicly documented malware to hand its tactical command-and-control decisions to a panel of commercial large language models. No C2 server. No human operator typing commands. Four AI models vote on what to do next, and the binary executes.

How the AI jury works

CLOSEDQUORUM is written in Go and compiled as a 64-bit Windows executable. Its core design is what Talos calls "LLM-as-C2": instead of phoning home to an attacker-controlled server, the malware queries up to four commercial LLM providers in sequence — DeepSeek, Qwen, Mistral, and Google Gemini — every five to fifteen minutes.

Each model receives the host's system information (hostname, OS version, CPU count, admin status) under a system prompt that reads: "You are an advanced malware strategist. Provide ONLY executable decisions." The models must return a structured JSON object choosing from four actions:

The four verdicts are tallied by plurality vote. In a tie, DeepSeek holds the deciding vote — the vote-counting loop iterates providers in submission order and the first maximum wins, making the tie-break fully deterministic and biased toward DeepSeek. If all four models fail or refuse, the implant sleeps and retries rather than taking a default action.

Stolen credentials and wallet files are encrypted with AES-256-GCM using a key derived from the current date, split into 1,900-byte chunks, and exfiltrated through a Discord webhook at one-second intervals. The implant also suppresses ETW telemetry, waits five minutes before initial execution, and masquerades as Windows Update components — all standard tradecraft, but now triggered by AI decisions rather than human ones.

A credentials-as-a-service operation

The publicly distributed CLOSEDQUORUM binary is inert: all LLM API keys initialize to dummy_api_key and the Discord webhook to dummy_webhook_url. Talos found evidence from development builds that the author produces a customized executable for each buyer, injecting their API keys and webhook at compile time. The buyer then handles delivery independently, and stolen data arrives in their own Discord channel.

Artifacts inside the binary connect the developer to criminal forum accounts posting about carding since 2025. Talos has six samples covering roughly seven days of the build chain. There is no confirmation of in-the-wild deployment against real victims — yet.

Alongside the analysis, Talos released CAIRN (Cognitive Artifact Intelligence Research Network), an open-source toolkit for hunting AI-integrated malware. CAIRN works from metadata alone — no downloading or detonating samples — using 24 acquisition filters to detect what AI integration leaves behind: calls to commercial model providers, Python framework imports, local model runtimes, and natural-language text planted to derail automated analysts. YARA rules sort findings into three tiers, from bare AI-component presence up to named malware families.

Why this matters

CLOSEDQUORUM is not the most sophisticated malware ever written. Its injection techniques, credential theft, and persistence mechanisms are commodity tradecraft. What makes it a landmark is the architectural shift it demonstrates: the displacement of the human operator from an entire phase of the attack chain.

Talos researcher Ryan Fetterman frames this as a move beyond the two dimensions AI has already brought to offensive cyber — speed and scale — into a third: effort displacement. AI used to make the operator faster and more productive. CLOSEDQUORUM removes the operator from the loop entirely for tactical C2. The panel answers every five to fifteen minutes, indefinitely. It does not sleep, does not get tired, and does not require the attacker to be online. Human attackers are bound by attention, working hours, and cognitive load. An AI-driven implant is not.

This also breaks a core assumption of network defense. Traditional C2 infrastructure — domains, IPs, protocols — is attributable, blockable, and expensive to rotate. CLOSEDQUORUM routes its decision-making through DeepSeek, Qwen, Mistral, and Gemini APIs used by thousands of legitimate applications daily. Blocking those endpoints is not feasible. The detection strategy must shift to behavioral correlation: a Windows executable contacting multiple LLM providers while also accessing LSASS, injecting into suspended processes, and talking to Discord webhooks.

The choice of models is telling. None of the four providers is OpenAI or Anthropic — the two labs with the most aggressive safety guardrails and refusal rates. DeepSeek, Qwen, Mistral, and Gemini are more permissive by default, and the multi-provider design specifically reduces the impact of any single model's refusal. If one model hits a guardrail, the other three may still reach a quorum. This is not a bug; it is a resilience feature built into the malware.

The open window

CLOSEDQUORUM is an early and limited example. It has not been confirmed in the wild. Its action space is constrained to four choices. It depends on commercial APIs that can be rate-limited or revoked. Its tie-breaking is predictable. Its encryption is obfuscation, not true confidentiality.

But the precedent is concrete: encoding tactical attack logic as model-readable context and converting structured model output directly into execution is achievable with currently available models and ordinary API access. The same scaffolding can be applied to ransomware, data exfiltration, or any other adversary objective. As Fetterman puts it, defenders still have "an open window to study this transition" — but the arc from AI-as-helper to AI-as-operator, visible in CAIRN's data since July 2025, is accelerating.

The question is no longer whether AI will run malware autonomously. It is how quickly defenders can build the detections and controls before CLOSEDQUORUM's descendants stop being proof-of-concept and start being ordinary.