The Malware Asked the Models

CLOSEDQUORUM encodes a bounded attack phase as decisions by commercial language models. Cisco Talos can inspect the design. It cannot yet show that the publicly distributed sample completed an intrusion.

Evidence status: Cisco Talos published its reverse engineering on September 22. It found an autonomous decision loop in a Windows executable and development artifacts consistent with configured builds. The public sample contains placeholder credentials and a dummy webhook; Talos reported no confirmed deployment in the wild or complete end-to-end execution of that distributed build.

The usual malware command-and-control picture has an operator on one side of a network and a compromised machine on the other. The operator tells the implant what to do. Defenders try to discover the connection, recognize the infrastructure, and break it. CLOSEDQUORUM, a sample analyzed by Cisco Talos, proposes a different arrangement for one part of that job: the executable gathers information about the host, sends structured questions to several language-model services, tallies their answers, and selects from a short menu of malicious actions.

The temptation is to call this an AI cyberattack already under way. The evidence supports a narrower and more useful account. Talos has a 16.4 MB Go-based Windows implant to examine. Its static analysis found the model orchestration and action handlers. Development artifacts suggest that service credentials can be injected at build time. But the publicly distributed binary has dummy API keys and a dummy Discord webhook, and the researchers did not observe its complete operation in a live campaign. An architecture is observable; operational prevalence is not.

The decision is smaller than the headline

The implant’s model panel can include DeepSeek, Qwen, Mistral, and Gemini. It queries available providers sequentially and asks for structured output. The chosen action comes from a constrained schema. Talos identifies handlers for stealing credentials and wallet data, persistence, and process injection. A “move” choice lacks a corresponding handler in the distributed build. The models are not free to invent arbitrary tools and have them executed by magic. They select among capabilities the developer coded.

That boundary is central to understanding both danger and fragility. A human malware operator can inspect a network, improvise a new payload, and decide that an unexpected response requires abandoning an attempt. CLOSEDQUORUM’s loop compresses tactical judgment into a few parsed fields and routes to existing functions. If an answer fails to parse or names an unsupported action, the executable cannot carry it out. Talos says that when all model calls fail, the fallback is a string without a matching capability handler; the loop sleeps and tries again. “Autonomous” here means the operator need not issue each tactical command, not that the code has unlimited ingenuity.

Plurality voting gives the design its name. The models provide decisions, and the implant counts the selected labels. A tie is resolved by the order in which providers are queried, favoring DeepSeek if it answered, then Qwen, Mistral, and Gemini. That is not a deep deliberative quorum. It is a deterministic software rule. It may tolerate one provider refusing or timing out; it may also produce a stable bias that a defender or provider can study. The security significance is not that four minds outvote one another. It is that ordinary API responses can become executable control input.

The operator still exists

Talos infers a model in which a developer prepares a customized executable with provider keys and an operator’s Discord webhook, then the operator delivers it to a target. The public build is inert as distributed. This inferred service model is plausible from the build artifacts and embedded placeholders, but it is not a verified customer list, sales record, or intrusion log. The operator still has to acquire access, place the executable, pay for or obtain API credentials, and receive any stolen output.

The implant’s intended theft targets include Windows credential material, browser password stores, and cryptocurrency-wallet files. Talos describes reporting and exfiltration through Discord. It also describes several persistence and injection mechanisms. Those capabilities are conventional enough that defenders should not look for a wholly new class of magic behavior. The novel piece is the control loop that chooses among them and sends the choice to the reporting channel.

There is a second misconception in saying the model providers “host the C2.” A provider API supplies answers to attacker-written prompts; it need not know the intended use, and the provider is not necessarily running the attacker’s server or receiving exfiltrated credentials. The implant still uses a Discord webhook for reporting and stolen material. The architecture disperses decision requests across legitimate services and makes simplistic domain blocking harder, but it does not erase network evidence or make the malware indistinguishable from authorized software.

Talos identifies a useful conjunction: an unexpected executable contacts multiple model APIs in a short period while also touching credential stores, creating persistence, or injecting code, and then communicates with Discord. Each individual signal can be legitimate in some environment. Their timing and co-occurrence narrow the explanation. A developer workstation may call models and Discord; a security tool may inspect LSASS under authorization. A random process doing all of those things without a documented purpose deserves investigation.

More automation, more dependencies

The same external services that reduce an attacker’s need to maintain a classic command server create new failure points. Provider refusal, rate limits, revoked keys, billing stops, malformed responses, network isolation, and different model behavior can interrupt the chain. The prompt must carry enough host context to produce a useful decision, which may expose suspicious content to provider-side systems. A defender cannot assume that every HTTPS call to a major model service is benign, but cannot safely declare all such calls malicious either.

The model outputs are especially interesting as evidence. If a service provider preserves request and response records under applicable retention policies, an investigation may reconstruct the context sent, the decisions proposed, and the time of each call. Whether such logs actually exist, can be attributed to a given operator, or are available to investigators is unknown from Talos’s public analysis. The possibility is a hypothesis for incident responders to test. It also creates an uncomfortable symmetry: outsourcing tactical decisions may outsource traces of attacker behavior.

This dependency raises an economic question too. Four separate model calls per decision cycle can cost more, incur more latency, and create more chances for a refusal than one local rule or one remote operator command. Talos reports a randomized interval of five to fifteen minutes between cycles, so the design is not a millisecond-by-millisecond controller. It is suited to patient, repeated decisions after an implant has already landed. A future field report should compare the number of completed decisions with failed calls, token expenditure, and the value of any stolen material before claiming that the architecture is cheaper or more effective than conventional automation. The public sample contains no such operating ledger.

The implant’s constrained schema offers another defensive distinction. The “AI” label does not supersede endpoint telemetry. Credential dumping and process injection are observable behaviors independent of who chose them. Security teams can tune for combinations of system calls, file access, persistence creation, and outbound service patterns, while treating model-provider endpoints as context rather than universal indicators. An attacker could later change the providers, proxy calls, or use a local model; detections tied only to four company names would age quickly.

What the sample proves

Static analysis can establish that a binary contains code paths for model calls, voting, and action dispatch. It can reveal hard-coded placeholders and build artifacts. It cannot by itself establish that an operator bought the program, that all external services accepted the prompts, that the malware successfully persisted on a real victim, or that credentials were stolen. The sample’s relationship to criminal-forum postings is another attribution chain that requires care: a developer connection does not make every claimed deployment true.

Talos calls CLOSEDQUORUM a reference example of effort displacement. That term is useful if kept modest. Instead of a human selecting every next action, a model panel selects from predefined options. It can keep cycling while a human is absent. The potential scale advantage becomes meaningful only if the whole system works reliably across diverse machines and defenses. The public record does not yet measure reliability, success rate, harm, or prevalence.

This distinction also separates the sample from legitimate continuous offensive testing. A company can authorize a security agent to test its own environment, set scope, retain logs, and stop it. An intruder can use superficially similar decision machinery without consent. The consequential property is not merely a model call; it is the relationship among authority, capability, evidence, and target. An incident report should establish those elements before calling an AI system either a defender or an attacker.

The evidence that would move the story

An independently corroborated victim, configured sample with working credentials, execution telemetry showing successful model responses and action dispatch, or provider records would move CLOSEDQUORUM from an architecture report toward an operational campaign report. Conversely, proof that the action paths cannot execute as described, or that the development build was a nonfunctional demonstration, would weaken the operational implications. The currently distributed binary does not settle either question.

The interesting threshold has nevertheless been crossed in code: a malware author has encoded a bounded tactical menu and a parser that turns language-model output into program action. Defenders should study that control boundary now, without giving an unproven campaign the scale and sophistication of a proven one. The sample does not require belief in a superintelligent adversary. Ordinary APIs, predictable voting, brittle parsing, and familiar theft routines are enough to make a testable new architecture.

Method and source trail

Cyberdelia separated static code observations, Talos’s inferred distribution model, and unverified real-world deployment. It did not run the executable. Primary source: Cisco Talos, “The Closed Quorum,” September 22, 2026, including the researchers’ explicit caveat about dummy credentials and the lack of an observed end-to-end run. Detection suggestions here are analytical implications of Talos’s reported behavior, not evidence that a particular victim was infected.