On September 22, 2026, Cisco Talos released CAIRN, an open-source research toolkit built to hunt, classify and track a new class of malware that leans on commercial AI models rather than traditional attacker infrastructure. Alongside the tool, Talos published its first finding: CLOSEDQUORUM, a Windows implant that, to Talos's knowledge, is the first publicly documented case of a piece of malware handing its tactical command-and-control decisions to a panel of commercial large language models instead of contacting a server the attacker runs.
DeepSeek
Qwen
Mistral AI
GeminiWhat Talos found
CAIRN stands for Cognitive Artifact Intelligence Research Network. It is a metadata-first hunting toolkit: it searches for the traces AI-integrated malware tends to leave, such as embedded provider API endpoints, AI framework imports and agentic tool-call syntax, without needing to execute the sample. Talos built it because it expected this class of malware to keep appearing and wanted defenders to have a shared, extensible way to find and classify it early.
CLOSEDQUORUM is the toolkit's first documented catch. It is a 16.4 MB, 64-bit Windows executable compiled in Go. Once running, it wakes on a randomized interval of roughly five to fifteen minutes, gathers basic host context, and queries up to four commercial LLM providers, DeepSeek, Qwen, Mistral and Google Gemini, in parallel. Each provider returns one verdict from a small fixed set of options that Talos catalogued during analysis, and the implant tallies the results by plurality vote: whichever option receives the most votes is the one it carries out. If the vote ties, DeepSeek's answer wins. The stated objective is credential and cryptocurrency theft, and Talos frames the design as a potential "credentials-as-a-service" offering in which the real product an operator is selling is the autonomous orchestration layer itself, not any single piece of malware code.
A voting panel instead of a command server
As documented by Cisco Talos, CLOSEDQUORUM never contacts a dedicated attacker-operated server. Every decision is settled by counting votes from four commercial LLM providers.
Source: Cisco Talos, “The Closed Quorum: Inside the first reported autonomous AI C2 implant,” September 22, 2026. Talos has not confirmed this design was ever deployed against a real target.
It is worth being precise about what has and has not been shown. Talos has no confirmation that CLOSEDQUORUM was ever deployed against a real target. The publicly examined build shipped with placeholder API keys and a non-functional template configuration, and the autonomous voting loop was confirmed through static analysis and development artifacts, not through observed traffic from an active campaign. Talos does report that other artifacts in the same binary connect its developer to carding-related postings on criminal forums dating back to 2025, which is evidence of intent and capability, not evidence of a live operation. The honest framing is that CLOSEDQUORUM is a documented design for autonomous AI command-and-control, not a confirmed attack.
CLOSEDQUORUM is an early and limited example, but it makes an emerging threat model concrete and gives defenders an outline of observable signals.
Cisco Talos
Why routing C2 through commercial APIs is architecturally different
Command-and-control has always had a weak point defenders could aim at: the server. Sinkhole it, seize it or block traffic to it, and the implant goes quiet. Routing decisions through commercial LLM providers removes that single point of failure. There is no attacker-owned domain to take down, because the traffic goes to api.deepseek.com, api.mistral.ai and similarly legitimate endpoints that plenty of ordinary software also calls. A Windows process contacting one AI provider is unremarkable on its own; it is the pattern around that call, querying four providers at once while also touching credential stores or injecting code, that stands out.
What changes when the C2 server is a vote, not a machine
The shift is architectural, not just a new detection signature. Each row is a property defenders have historically relied on when a C2 design still has a fixed server.
Comparison built from Cisco Talos's September 22, 2026 CLOSEDQUORUM disclosure. CLOSEDQUORUM has not been confirmed running against a real target.
The plurality-vote design adds a second layer of resilience on top of that. Any single commercial provider can refuse a request, rate-limit an account, return a malformed response, or simply have an outage. A design that depended on one model would stall every time that model said no or fell over. Spreading the same decision across four independent providers means the implant keeps functioning as long as a majority of them answer at all, and it means no single provider's safety filtering can unilaterally shut the operation down. That is the actual innovation Talos is flagging: not that an LLM can pick an attack action, which is a fairly small capability, but that voting across several providers turns any one provider's refusal into a single outvoted opinion rather than a hard stop.
The detection challenge, and how CAIRN answers it
Traditional network defense leans heavily on knowing what "bad" infrastructure looks like: a suspicious domain, an unusual IP, a certificate that does not match. None of that applies here, because the infrastructure is entirely legitimate. Talos's stated answer is to shift from signature and domain-based detection toward behavioral correlation: a host that queries multiple distinct AI provider APIs in the same short window, while also dumping LSASS memory, reading browser credential stores, or setting up persistence, is a far more specific signal than any one of those actions alone. CAIRN operationalizes the same instinct at the hunting stage. Rather than waiting to catch a sample executing, it searches existing malware repositories and sandbox telemetry for the metadata AI-integrated tooling tends to leave behind, provider endpoints, framework imports, prompt fragments, agentic tool-call syntax, and runs it through a tiered YARA rule set that separates a primitive artifact from a confirmed family. Talos reports that this approach alone surfaced roughly twenty additional AI-integrated malware samples beyond the handful of named families already known publicly, which is itself a useful data point about how much of this activity has been sitting unclassified rather than genuinely absent.
What this means for anyone building on commercial model APIs
The uncomfortable symmetry here is that the properties making multi-provider orchestration valuable for legitimate agentic software, resilience to any single vendor's downtime, refusals or rate limits, are exactly the properties CLOSEDQUORUM's design tries to exploit for malicious ends. That puts real weight on provider-side abuse monitoring: rate-limit anomalies, unusual API key provisioning patterns, and requests structured as narrow forced-choice decisions rather than open-ended conversation are all plausible signals providers can watch for, independent of what the requesting process on the other end is actually doing. It also puts weight on enterprise practice. A team that already runs multiple models through one governed platform, with per-provider logging, credential custody kept off individual endpoints, and visibility into what each call is actually being used for, is in a far better position to catch this pattern than one where every application manages its own scattered set of API keys. That is part of the case for model-agnostic platforms like Metir, which route work across providers under one governance layer rather than leaving credentials and call patterns to accumulate invisibly across dozens of separate integrations.
The window is still open
Talos's own framing is the right note to end on. CLOSEDQUORUM is early, limited, and unconfirmed as an active threat, but it is not hypothetical: it is a working design that a real developer built and, per Talos, connected to criminal-forum activity. The advantage, as Talos puts it, is that this progression is still only beginning, which leaves defenders a genuine window to study the transition before it is a routine part of the malware landscape rather than a single documented case. CAIRN is Talos's attempt to use that window, and the more interesting test of it will be whatever it turns up next.
Sources:
- The Closed Quorum: Inside the first reported autonomous AI C2 implant | Cisco Talos
- Cisco Talos Open-Sources CAIRN to Hunt AI-Integrated Malware | Unite.AI
- Talos releases CAIRN, uncovers LLM-voting malware CLOSEDQUORUM | AI Weekly
- Cisco Talos finds malware taking orders from a four-model committee | RuntimeWire
- Researchers uncover malware that uses AI to choose its next move | Help Net Security
Image credits
Hero image: a building on Cisco Systems' San Jose, California main campus, photographed by Mike Linksvayer, via Wikimedia Commons, released under the CC0 1.0 public domain dedication. In-body photograph: the CERN Computer Center server room, by SimonWaldherr, via Wikimedia Commons, licensed under CC BY-SA 4.0. It is an illustrative photo of generic data center infrastructure and does not depict Cisco's, DeepSeek's, Qwen's, Mistral's or Google's own facilities.