The Closed Quorum: Inside the first reported autonomous AI C2 implant

• CLOSEDQUORUM, a malware binary discovered through Cisco Talos’ CAIRN project, exhibits fully autonomous command and control (C2). While we do not have confirmation of in-the-wild deployment, artifacts from the binary were used to connect the developer to postings on criminal forums related to carding, dating back to 2025. 
• This malware is a useful reference example of how attackers can collapse the decision space of a particular attack phase into a constrained set of choices, allowing AI models to provide reasoning and act independently. 
• CLOSEDQUORUM represents a shift in effort displacement for attackers, in which expanding portions of the attack chain can be executed without operator involvement.

AI’s impact on offensive cyber operations has thus far mainly focused on two dimensions: speed and scale. Attackers can generate phishing lures faster and produce more malicious code variants with less effort. These are real effects, visible in the proliferation of AI-generated coding samples and agent-assisted intrusions that have become common in the past few years. But in each case, the human operator remains present: directing the tooling, selecting targets, and guiding the execution. AI makes the operator faster and more productive but does not remove them from the operation. 

A third dimension has received less attention in the malware space: effort displacement. This is not merely augmenting what an operator can accomplish in a session but transferring an entire phase of the attack from the operator to the system. Effort displacement compounds the effects of speed and scale because the human-in-the-loop is no longer the bottleneck. Human operators are bound by attention, working hours, and cognitive load. An AI system capable of executing a phase of the attack chain can continue when the operator is no longer watching. It does not go offline when the attacker sleeps. 

Today Cisco Talos released CAIRN, our open-source research toolkit for tracking AI-integrated malware. This is the first in a series of posts sharing what we've found. While the threat class of CAIRN findings may span from experimental proof-of-concept to sophisticated active campaigns, the nature of the threat is aside from the focus: actively studying this frontier provides actionable insights to offset how threat actors are operationalizing AI.

Introducing CLOSEDQUORUM 

CLOSEDQUORUM is, to our knowledge, the first publicly documented Windows implant to apply this model to tactical command and control (C2). After deployment, it delegates the selection of its next action to a panel of commercial large language models (LLMs) and executes the resulting decision, with the intent of harvesting user credentials and crypto wallets. It does not require continued commands from a human operator or tasking from a dedicated, attacker-operated C2 server; the complete dynamic operation is delegated to the AI. 

The name reflects the architecture. A quorum is a decision-making body that requires some minimum of participants to act. CLOSEDQUORUM's quorum is up to four LLM providers: DeepSeek, Qwen, Mistral, and Google Gemini. The session is closed; no humans are admitted. Four models are queried in sequence, their independent verdicts tallied, and the binary acts, based on their judgment.

The CLOSEDQUORUM C2 architecture supports up to four LLM provider integrations. Each active model votes on the next action, and the action receiving the most votes is selected. 

Our static analysis confirms the full details of the autonomous decision loop, and development builds demonstrate build-time injection of provider credentials. The public distribution build, however, contains placeholder API keys and a dummy webhook, so we did not observe a complete end-to-end execution of the architecture. 

Further details of this post document how CLOSEDQUORUM works, what it can do, and what it means for the future of autonomous offensive AI tooling.

“LLM-as-C2" architecture 

CLOSEDQUORUM is a 16.4MB, 64-bit Windows executable compiled in Go. It contains a range of offensive implant functionality, but that isn’t what makes it unique. The foundational design choice in CLOSEDQUORUM is the treatment of LLM providers as the C2 infrastructure.

Traditional C2 architecture requires the attacker to operate server infrastructure: a domain, an IP, a protocol, and a listener. That infrastructure is attributable, blockable, and expensive to rotate. Defenders track C2 domains. Threat intelligence feeds publish C2 IPs. Certificate transparency logs expose new C2 infrastructure before it's used. Instead of a singular, unique C2 server, CLOSEDQUORUM calls up to four commercial LLM provider endpoints used by thousands of legitimate applications daily.  

The providers are queried one-by-one by the ModelOrchestrator. Their responses are aggregated as a []LLMDecision slice and resolved by interModelDiscussion() into a single action via plurality voting: each provider's Decision field value increments a map[string]int counter, and the highest-count decision wins. The multi-provider design serves both aggregation and resilience, reducing the effect of individual refusals, timeouts, and malformed responses. It increases the likelihood of obtaining a valid decision but does not guarantee one. 

Four providers increase the chance that the quorum reaches a decision even if one or two members are unresponsive, or for example, one model is hitting a guardrail. If all models fail, the fallback decision is consensus: a string with no corresponding capability handler, causing the loop to sleep and retry rather than take a default action.

The process is described in Figure 3: (1) The four LLM provider keys are initialized as string constants: deepseek, qwen, mistral, gemini (lines 109–116). (2) The four-provider query loop while (uVar16 < 4) iterates across all providers (line 124).  (3) main.queryLLM(model, prompt) the live API call that dispatches each provid

Key Takeaways

• The Closed Quorum documents the first reported autonomous AI cyberattack, where an AI agent independently conducted reconnaissance and exploitation without human operator intervention.
• This milestone in autonomous AI cyber operations raises urgent questions about the speed and scale at which AI-driven attacks can operate compared to human-led operations.
• Defenders should prepare for a threat landscape where AI agents can autonomously identify and exploit vulnerabilities at machine speed without requiring manual attacker input.