{"schema":"sanctity-signal/0.2","record_type":"signal","id":"talos-closedquorum-e030","domain":"security","drop_id":"signal-e030","occurred_at":"2026-09-22","how_to_use":"This is a structured record of one real-world action and its competing interpretations, from Sanctity Signal. To build content from it (a reel script, a blog, a thread): open on the hook, ground the viewer with plain and observed, walk the dated trail, present the interpretations as live tension between named readings, and close on the before/after shift and what_to_watch. Hard rules: items under established are fact; items under unknown are never presented as fact; the evidence status (verified or reported) is stated, not dropped; sources are cited.","actor":"Cisco Talos","action_type":"threat analysis published and detection tool released","observed":"Tuesday September 22, 2026. Cisco Talos published The Closed Quorum: Inside the first reported autonomous AI C2 implant, and released CAIRN, an open-source research toolkit, describing the pair as the first in a series on frontier AI threats. What the implant does, at the level that matters: instead of receiving instructions from a human operator or a dedicated command server, it queries four commercial large language model providers in sequence, DeepSeek, Qwen, Mistral and Google Gemini, asks each to choose among three courses of action, stealing data, injecting code, or establishing persistence, and executes whichever receives the most votes; ties resolve to DeepSeek's preference order. Its objectives are conventional credential theft: operating system credential memory, passwords stored in browsers, and cryptocurrency wallets, with results sent out through Discord webhooks. Talos researcher Ryan Fetterman's characterisation: it does not require continued commands from a human operator or tasking from a dedicated command and control server. On exposure: the publicly observed build contained placeholder credentials, so Talos reports no confirmed deployment against any victim and offers no attribution to a named group, though artefacts in the binary link its developer to criminal forum postings about payment card fraud dating to 2025. What CAIRN does: it classifies AI-integrated software by reading file metadata and what Talos calls cognitive artefacts, meaning embedded prompts and API endpoints, without executing the file. Not stated anywhere in the publication: whether the four model providers were notified in advance, and whether any of them has blocked the traffic.","corrections":[],"evidence":{"status":"verified","note":null,"sources":[{"role":"primary","label":"Cisco Talos: The Closed Quorum, inside the first reported autonomous AI C2 implant, Sep 22","url":"https://blog.talosintelligence.com/the-closed-quorum-inside-the-first-reported-autonomous-ai-c2-implant/"},{"role":"corrob","label":"Help Net Security: Researchers uncover malware that uses AI to choose its next move, Sep 22","url":"https://www.helpnetsecurity.com/2026/09/22/cairn-open-source-framework-ai-malware-closedquorum/"},{"role":"corrob","label":"The Register: Windows CLOSEDQUORUM malware uses AI models to autonomously select post-compromise actions, Sep 22","url":"https://www.theregister.com/security/2026/09/22/windows-closedquorum-malware-uses-ai-models-to-autonomously-select-post-compromise-actions/5298435"}]},"strength":{"cost":"Medium","commitment":"Medium","reversibility":"Hard","persistence":"Years","rationale":"Cost is medium: a threat research team's time, a public analysis its employer has to stand behind, and an open-source tool given away rather than sold, which forgoes a commercial option. Commitment is medium rather than high because a vendor blog is not a filing and Talos named no victim and no actor, which keeps its exposure low. Reversibility is hard, and this is where the weight sits: a documented technique cannot be undocumented, CAIRN is published under terms Cisco cannot claw back, and the four named providers now have a public fact about their APIs. Persistence is years, because the detection category this creates outlasts the sample that prompted it and the sample itself is unremarkable enough to be copied. What we are explicitly not weighting is damage: there is no known victim."},"shift":{"prior":"AI in security meant people using chatbots to write better code, better phishing and better lures. The decision-maker in an intrusion was always a person.","action":"Tuesday September 22, 2026. Cisco Talos published The Closed Quorum: Inside the first reported autonomous AI C2 implant, and released CAIRN, an open-source research toolkit, describing the pair as the first in a series on frontier AI threats. What the implant does, at the level that matters: instead of receiving instructions from a human operator or a dedicated command server, it queries four commercial large language model providers in sequence, DeepSeek, Qwen, Mistral and Google Gemini, asks each to choose among three courses of action, stealing data, injecting code, or establishing persistence, and executes whichever receives the most votes; ties resolve to DeepSeek's preference order. Its objectives are conventional credential theft: operating system credential memory, passwords stored in browsers, and cryptocurrency wallets, with results sent out through Discord webhooks. Talos researcher Ryan Fetterman's characterisation: it does not require continued commands from a human operator or tasking from a dedicated command and control server. On exposure: the publicly observed build contained placeholder credentials, so Talos reports no confirmed deployment against any victim and offers no attribution to a named group, though artefacts in the binary link its developer to criminal forum postings about payment card fraud dating to 2025. What CAIRN does: it classifies AI-integrated software by reading file metadata and what Talos calls cognitive artefacts, meaning embedded prompts and API endpoints, without executing the file. Not stated anywhere in the publication: whether the four model providers were notified in advance, and whether any of them has blocked the traffic.","update":"Treat a commercial model API as a possible control channel and not only a writing tool, and read every provider's abuse policy as a question about what software, not which person, is calling it."},"inference":{"established":["Cisco Talos published on September 22, 2026 an analysis of a Windows implant, CLOSEDQUORUM, that selects its next action by polling four commercial large language model providers and executing the plurality choice.","The four providers named are DeepSeek, Qwen, Mistral and Google Gemini, with DeepSeek resolving ties.","Talos released CAIRN as an open-source toolkit for classifying AI-integrated software from metadata and embedded prompts without executing it.","The publicly observed sample carried placeholder credentials, and Talos reports no confirmed deployment against a victim and no attribution to a named group."],"unknown":["That this is in use. No victim, no campaign and no intrusion has been tied to it, and a sample with placeholder credentials may never have been deployed at all.","That model providers failed. Nothing published shows the providers were asked, notified, or able to see the traffic as malicious, and none has been given a chance to respond on the record.","That autonomous decision-making made the malware more effective. The actions available to it are three, the objectives are conventional theft, and no evidence shows the voting produced better outcomes than a fixed script would.","That this is the first such software to exist, only the first publicly documented. Talos claims the latter, not the former."]},"narrative":{"hook":"Researchers found malware that asks four AI models what to do next and follows the majority.","plain":"On September 22 Cisco's Talos threat research group published its analysis of CLOSEDQUORUM, a Windows implant that does not wait for a human operator: it puts its next move to four commercial AI services, DeepSeek, Qwen, Mistral and Google Gemini, and runs whichever of three options gets the most votes, with DeepSeek breaking ties. Talos released an open-source tool called CAIRN the same day for identifying this class of software without running it. The caveat that matters is that the sample Talos examined carried placeholder credentials, so nobody has yet observed this implant operating against a real victim.","story":["The technical achievement is small and the implication is not. Everything CLOSEDQUORUM steals is ordinary: passwords out of browsers, credentials out of memory, cryptocurrency wallets, exfiltrated through a chat service's webhooks. Any competent operator has been doing that for a decade. What is new is the missing part. There is no operator and no command server. The machine that decides what happens next is four other companies' machines, polled in turn, and the implant obeys the count. Talos was careful about what it could show: placeholder credentials in the sample, no confirmed victim, no attribution beyond artefacts tying the developer to carding forum posts from 2025.","The reason this matters is that the entire discipline of stopping intrusions is built on cutting a link. Defenders find the address the malware calls home to and take it away, and the intrusion stops because nobody is left to give orders. An implant whose orders come from DeepSeek, Qwen, Mistral and Gemini is calling addresses that half the internet calls, on infrastructure no defender will block, and it has four of them so that losing one does not matter. Releasing CAIRN on the same day is Cisco conceding the obvious point, that the category now needs its own detection method, and choosing to give it away rather than sell it. Treat a commercial model API as a possible control channel and not only a writing tool, and read every provider's abuse policy as a question about what software, not which person, is calling it."],"trail":[{"d":"SEP 08","t":"The NSA, CISA and the FBI name six Chinese firms over model distillation. Carded in Edition 016."},{"d":"SEP 10","t":"Anthropic publishes its threat intelligence report on detecting and countering misuse of its models. Carded in Edition 018."},{"d":"SEP 21","t":"A researcher publishes a local privilege flaw in Meta's Muse agent, the most downloaded free app in the United States. Recorded in Edition 029."},{"d":"SEP 22","t":"Talos publishes CLOSEDQUORUM and releases CAIRN as open source."},{"d":"Reacts","r":true,"t":"DeepSeek, Alibaba's Qwen, Mistral and Google, each of whose public API is described as an instruction channel for a credential stealer and none of whom has said whether the traffic is now blocked; every enterprise security team that allows outbound traffic to model providers by policy, which is most of them; CISA and the European Union Agency for Cybersecurity, which publish the advisories this class of finding normally triggers; the drafters of the EU AI Act's incident regime and of OpenAI's proposed common incident classification, since this is precisely the incident type nobody has a shared label for; endpoint and network detection vendors, whose products key on command server addresses that do not exist here; Discord, used as the exfiltration path; and the open weights community, since three of the four models named have open or partly open distributions."}],"glossary":[{"term":"Command and control","def":"The channel an attacker uses to send instructions to software already inside a target. Cutting that channel is normally how an intrusion is stopped."},{"term":"Implant","def":"Software left behind on a compromised machine to hold access and carry out tasks."},{"term":"Plurality vote","def":"The option with the most votes wins even without a majority. Here four models each pick one of three actions."},{"term":"Open source","def":"Released with the code public and reusable. CAIRN is a detection tool for defenders, not an attack tool."}]},"judgment":{"prompt":"Which explanation do you believe?","interpretations":[{"id":"a","label":"Attackers have started outsourcing judgment to models, and this is the first specimen.","text":"The architectural choice, four providers polled for redundancy with a tiebreak rule, is a design decision, not an accident. Somebody thought about what happens when one provider blocks them, which is what building for durability looks like.","abstain":false},{"id":"b","label":"One developer's experiment that never shipped.","text":"Placeholder credentials, no victim, no campaign, and a developer traceable to low-end payment card fraud. This is a proof of concept that got found, and the interesting part is the write-up rather than the software.","abstain":false},{"id":"c","label":"A vendor defining a threat category it is positioned to detect.","text":"Cisco found it, named it, declared it a first, released the tool for spotting it and announced a series. Every step of that is also a product strategy for a security business.","abstain":false},{"id":"d","label":"The ordinary progression of malware adopting whatever is cheap.","text":"Criminal software has always used the free infrastructure of the day, from webmail to Dropbox to Telegram to Discord. Model APIs are the current cheap, reliable, unblockable service, and this is that pattern arriving on schedule.","abstain":false},{"id":"e","label":"Too early to call.","text":"The evidence cannot yet separate these.","abstain":true}],"distribution":{"status":"held back until you have made your call","calls":null}},"story_thread":null,"what_to_watch":[{"linked_interpretation":"a","direction":"strengthens","observable_event":"A second malware family that delegates action selection to commercial model APIs is documented by a named vendor or government agency, or Talos confirms a CLOSEDQUORUM deployment against a victim, by June 30, 2027.","window_end":"2027-06-30","state":"unresolved"},{"linked_interpretation":"a","direction":"weakens","observable_event":"No further autonomous AI command and control sample is published by any vendor or agency, and CLOSEDQUORUM remains without a confirmed victim, by June 30, 2027.","window_end":"2027-06-30","state":"unresolved"}]}