Confirmed in a primary source 22 Sept 2026 Security

Researchers found malware that asks four AI models what to do next and follows the majority.

On September 22 Cisco's Talos threat research group published its analysis of CLOSEDQUORUM, a Windows implant that does not wait for a human operator: it puts its next move to four commercial AI services, DeepSeek, Qwen, Mistral and Google Gemini, and runs whichever of three options gets the most votes, with DeepSeek breaking ties. Talos released an open-source tool called CAIRN the same day for identifying this class of software without running it.

The caveat that matters is that the sample Talos examined carried placeholder credentials, so nobody has yet observed this implant operating against a real victim.

Until now

AI in security meant people using chatbots to write better code, better phishing and better lures. The decision-maker in an intrusion was always a person.

Now

Treat a commercial model API as a possible control channel and not only a writing tool, and read every provider's abuse policy as a question about what software, not which person, is calling it.

The technical achievement is small and the implication is not. Everything CLOSEDQUORUM steals is ordinary: passwords out of browsers, credentials out of memory, cryptocurrency wallets, exfiltrated through a chat service's webhooks. Any competent operator has been doing that for a decade. What is new is the missing part. There is no operator and no command server. The machine that decides what happens next is four other companies' machines, polled in turn, and the implant obeys the count. Talos was careful about what it could show: placeholder credentials in the sample, no confirmed victim, no attribution beyond artefacts tying the developer to carding forum posts from 2025.

The reason this matters is that the entire discipline of stopping intrusions is built on cutting a link. Defenders find the address the malware calls home to and take it away, and the intrusion stops because nobody is left to give orders. An implant whose orders come from DeepSeek, Qwen, Mistral and Gemini is calling addresses that half the internet calls, on infrastructure no defender will block, and it has four of them so that losing one does not matter. Releasing CAIRN on the same day is Cisco conceding the obvious point, that the category now needs its own detection method, and choosing to give it away rather than sell it. Treat a commercial model API as a possible control channel and not only a writing tool, and read every provider's abuse policy as a question about what software, not which person, is calling it.

How it got here

Sep 08
The NSA, CISA and the FBI name six Chinese firms over model distillation. Carded in Edition 016.
Sep 10
Anthropic publishes its threat intelligence report on detecting and countering misuse of its models. Carded in Edition 018.
Sep 21
A researcher publishes a local privilege flaw in Meta's Muse agent, the most downloaded free app in the United States. Recorded in Edition 029.
Sep 22
Talos publishes CLOSEDQUORUM and releases CAIRN as open source.
Who has to react
DeepSeek, Alibaba's Qwen, Mistral and Google, each of whose public API is described as an instruction channel for a credential stealer and none of whom has said whether the traffic is now blocked; every enterprise security team that allows outbound traffic to model providers by policy, which is most of them; CISA and the European Union Agency for Cybersecurity, which publish the advisories this class of finding normally triggers; the drafters of the EU AI Act's incident regime and of OpenAI's proposed common incident classification, since this is precisely the incident type nobody has a shared label for; endpoint and network detection vendors, whose products key on command server addresses that do not exist here; Discord, used as the exfiltration path; and the open weights community, since three of the four models named have open or partly open distributions.

The evidence

ObservedTuesday September 22, 2026. Cisco Talos published The Closed Quorum: Inside the first reported autonomous AI C2 implant, and released CAIRN, an open-source research toolkit, describing the pair as the first in a series on frontier AI threats.

The whole observation, as recorded

What the implant does, at the level that matters: instead of receiving instructions from a human operator or a dedicated command server, it queries four commercial large language model providers in sequence, DeepSeek, Qwen, Mistral and Google Gemini, asks each to choose among three courses of action, stealing data, injecting code, or establishing persistence, and executes whichever receives the most votes; ties resolve to DeepSeek's preference order. Its objectives are conventional credential theft: operating system credential memory, passwords stored in browsers, and cryptocurrency wallets, with results sent out through Discord webhooks. Talos researcher Ryan Fetterman's characterisation: it does not require continued commands from a human operator or tasking from a dedicated command and control server. On exposure: the publicly observed build contained placeholder credentials, so Talos reports no confirmed deployment against any victim and offers no attribution to a named group, though artefacts in the binary link its developer to criminal forum postings about payment card fraud dating to 2025. What CAIRN does: it classifies AI-integrated software by reading file metadata and what Talos calls cognitive artefacts, meaning embedded prompts and API endpoints, without executing the file. Not stated anywhere in the publication: whether the four model providers were notified in advance, and whether any of them has blocked the traffic.

Established

Cisco Talos published on September 22, 2026 an analysis of a Windows implant, CLOSEDQUORUM, that selects its next action by polling four commercial large language model providers and executing the plurality choice.
The four providers named are DeepSeek, Qwen, Mistral and Google Gemini, with DeepSeek resolving ties.
Talos released CAIRN as an open-source toolkit for classifying AI-integrated software from metadata and embedded prompts without executing it.
The publicly observed sample carried placeholder credentials, and Talos reports no confirmed deployment against a victim and no attribution to a named group.

Not established

That this is in use. No victim, no campaign and no intrusion has been tied to it, and a sample with placeholder credentials may never have been deployed at all.
That model providers failed. Nothing published shows the providers were asked, notified, or able to see the traffic as malicious, and none has been given a chance to respond on the record.
That autonomous decision-making made the malware more effective. The actions available to it are three, the objectives are conventional theft, and no evidence shows the voting produced better outcomes than a fixed script would.
That this is the first such software to exist, only the first publicly documented. Talos claims the latter, not the former.

Why it weighs this much

Signal strength

CostMedium

CommitmentMedium

ReversibilityHard

PersistenceYears

Cost is medium: a threat research team's time, a public analysis its employer has to stand behind, and an open-source tool given away rather than sold, which forgoes a commercial option. Commitment is medium rather than high because a vendor blog is not a filing and Talos named no victim and no actor, which keeps its exposure low. Reversibility is hard, and this is where the weight sits: a documented technique cannot be undocumented, CAIRN is published under terms Cisco cannot claw back, and the four named providers now have a public fact about their APIs. Persistence is years, because the detection category this creates outlasts the sample that prompted it and the sample itself is unremarkable enough to be copied. What we are explicitly not weighting is damage: there is no known victim.

What to watch

strengthens A second malware family that delegates action selection to commercial model APIs is documented by a named vendor or government agency, or Talos confirms a CLOSEDQUORUM deployment against a victim, by June 30, 2027.
weakens No further autonomous AI command and control sample is published by any vendor or agency, and CLOSEDQUORUM remains without a confirmed victim, by June 30, 2027.

The words

Command and control: The channel an attacker uses to send instructions to software already inside a target. Cutting that channel is normally how an intrusion is stopped.
Implant: Software left behind on a compromised machine to hold access and carry out tasks.
Plurality vote: The option with the most votes wins even without a majority. Here four models each pick one of three actions.
Open source: Released with the code public and reusable. CAIRN is a detection tool for defenders, not an attack tool.

Your call

Which explanation do you believe?

A call is final. Other people's calls show after yours.