Cisco Talos Finds a Windows Implant That Lets Four LLMs Vote on Its Next Move

On 22 September 2026 Cisco Talos published research on CLOSEDQUORUM, a Windows implant that does not wait for an attacker's instructions. Once it is running it describes the machine it has landed on, asks up to four commercial AI models what to do next — DeepSeek, Qwen, Mistral and Google Gemini — counts their answers as votes, and executes whichever of four actions wins. Talos calls it "to our knowledge, the first publicly documented Windows implant to apply this model to tactical command and control". The same post says Talos has no confirmation the implant was ever deployed, and that the copy circulating publicly does not work: its API keys and its exfiltration webhook are placeholders. No harm to any user is recorded. The full record, with its sources and severity grading, sits in the AI incident archive alongside the other documented AI-weapon findings.

What Talos says the implant does

The sample Talos describes is a 16.4MB, 64-bit Windows executable written in Go, with some C mixed in so it can call Windows system functions directly. Its novelty is not the payload. It is that the implant has no attacker-operated server to phone home to. Instead of a command-and-control domain, it uses the API endpoints of large language model providers — infrastructure that thousands of legitimate applications contact every day, and that therefore cannot be blocked on sight.

Each cycle, a routine collects basic facts about the host: its name, its Windows version and architecture, its processor count and whether the implant is running with administrator rights. That text is placed into a prompt and sent to the providers one at a time. The models are not asked for prose. Talos extracted the system prompt from the binary and quotes it: "You are an advanced malware strategist. Provide ONLY executable decisions." Each reply must deserialise into a typed structure whose decision field names one of four actions, or it is discarded.

The four actions route to capability modules that a human wrote and compiled into the binary. steal runs three collection routines together: a dump of Windows credential memory, saved browser passwords, and cryptocurrency wallet files. inject runs code inside another process. persist arranges for the implant to start again on its own. move, the lateral-movement option, has no handler at all in the build Talos examined — a model can vote for it and nothing happens.

The winning decision is posted to a Discord webhook before it is executed, so the operator watches the panel's choice and its stated reasoning arrive in a chat channel in real time. Stolen material goes to the same channel, encrypted with a key derived from the current date. Talos reads that choice sharply: because the developer always knows the date, it is "obfuscation, not true confidentiality separation between developer and operator".

What is established, and what is not

Talos is unusually explicit about the line, and it is worth keeping the two halves together. What static analysis establishes is the decision loop itself: the provider list, the query order, the vote counting, the typed reply, and the routing from a winning word to a capability. The binary was not stripped, so the function names that do this work are readable in the file. Development builds show provider credentials being written in at compile time.

What has not been established is that any of it ever ran a full cycle against a real machine. Talos states that the public distribution build is "an inert template": every model API key initialises to a placeholder string, the webhook initialises to a dummy address, and the binary is "non-functional as distributed". Talos says it "did not observe a complete end-to-end execution of the architecture". It also says, in the opening paragraph of the post, that it has no confirmation of in-the-wild deployment.

What Talos did find alongside the code was attribution of a sort. Artefacts from the binary connected its developer to postings on criminal forums about carding, the trade in stolen payment-card data, dating back to 2025. The post does not name the developer, and does not establish that the developer ran attacks with the tool. Talos assesses instead that the thing is a product: a developer compiles a customised executable for each customer with that customer's API keys and webhook built in, and the customer handles delivery. Talos calls the likely model "credentials-as-a-service", where the selling point is the orchestration layer.

No victim, no campaign and no deployment is recorded anywhere in this. The archive classifies the entry as a research finding rather than a deployment event, with no real harm recorded — which is a statement about what has been documented, not a claim that nothing happened.

The tie-break that undercuts the word quorum

The name invites a picture of four models deliberating until they agree. The implementation is looser than that. The winner is decided by plurality, not majority: the decision named by the most models wins, even if that is one vote out of four on a four-way split. Agreement is not required.

Ties are resolved without asking anyone again. Talos describes the counting loop as fully deterministic and biased toward DeepSeek: DeepSeek is queried first, the comparison keeps the first decision to reach the top count, so DeepSeek's vote carries every tie. If DeepSeek is unavailable, Qwen inherits the deciding vote, then Mistral, then Gemini. A defender who knows which providers answered can predict the outcome of a split without reading a single model reply.

There is a second, quieter design fact. If every model refuses, times out or returns malformed output, the fallback is not a default action. Talos says the fallback decision is a string with no matching handler, so the loop sleeps and retries. The implant is built to do nothing rather than guess.

What the word "first" is doing in that sentence

Talos's claim is narrower than most of the coverage implied, and the narrowing matters. The company says "first publicly documented Windows implant to apply this model to tactical command and control" — not first AI malware, and not first malware to use a language model. What is claimed as new is the shape of the delegation: several commercial providers polled as a redundant decision panel, choosing a tactic on the infected host.

That framing has been argued about, and the argument is about presentation rather than about the technical findings. An independent briefing published the same day by the analyst P.K. Sharma tests the claim and concludes that the narrow architectural claim holds against the public record, while "the broader impression that this is the debut of AI-driven malware does not" — pointing to earlier public cases in which malware queried a language model at runtime, most clearly LameHug, which Ukraine's CERT-UA reported in July 2025 and which used a model to generate the commands it then ran. On that reading, what changed in September 2026 is that the models choose the tactic instead of writing the command.

The reporting itself came in for the same treatment. On 23 September the outlet On the Wire noted that most trade coverage had kept Talos's finding and Talos's caveat together, but that "one widely-read headline did not", and singled out a headline asserting that AI malware had removed the human from the attack loop as unsupported by the research beneath it. A detection-engineering paper posted to Zenodo on 7 October put the same limit in a sentence: "Every claim is a claim about a design, not about a compromise."

None of these critics disputes what is inside the binary. The archive likewise does not record the entry as disputed. The disagreement is about how much a compiled capability, never seen running, should be allowed to imply.

The company that found it also sells the fix

One detail in the disclosure is worth stating plainly. CLOSEDQUORUM surfaced through CAIRN, Talos's own open-source toolkit for hunting AI-integrated malware, which Talos released the same day. Talos is a division of Cisco, which sells the network and endpoint products that address this class of threat. The Snort rule issued for the family, 1:66984, is a Cisco product, and its public rule documentation labels the known usage as "Attacks/Scans seen in the wild" — firmer phrasing than the research post's own statement that there is no confirmation of in-the-wild deployment. The rule documentation describes what the rule alerts on, not evidence of a victim, and the two statements are not formally contradictory; they are differently weighted. A reader weighing a vendor's finding should lean on the technical detail, which can be checked, rather than the framing, which cannot.

What defenders are told to look for

Because the infrastructure is legitimate, domain blocking is not available. Talos's guidance is behavioural correlation: no single signal identifies the implant, but a combination does. The list Talos gives is:

• API traffic to AI model providers originating from a Windows executable with no reason to be using one

• Similar requests sent to several providers within a short interval from the same process

• Prompts carrying host details or offensive capability language, visible only through TLS inspection or on the provider side

• Process injection, credential-memory access or new persistence on the same host

• Discord webhook traffic from that process or host

• Execution repeating at randomised intervals of five to fifteen minutes

The reasoning behind the multi-provider signal is the most transferable part of the finding. Legitimate software commits to one provider, or fails over to a second when the first errors. Software that fans out to four and compares the answers is doing something else. Talos published a YARA rule and the Snort rule alongside the post, and six SHA-256 hashes covering builds from roughly a week of development. The Hacker News reported on 23 September that the rule file shipped with CAIRN did not itself contain a CLOSEDQUORUM rule, so CAIRN users had to add Talos's rule by hand; the rule is published in the blog post.

What the disclosure changes

Very little about the present, and something about the near future. Talos is blunt in its own assessment: CLOSEDQUORUM is "best understood not as a sophisticated piece of malware, but as a demonstration that the architectural shift towards attack-chain automation is coming". The capabilities it can trigger are ordinary post-compromise tooling. What is new is that the choice of which capability to use next has been moved off the operator and onto a voting panel of commercial models, running whether or not anyone is awake.

Talos's word for that is effort displacement, and it is a claim about where a phase of an attack lives rather than how fast it runs — the operator is not made quicker, but removed from a decision. The same design, Talos notes, hands defenders a set of weaknesses to work with: providers refuse, rate-limit and return malformed output, the action space is four words wide, and the tie-break is predictable. Autonomy here trades human limits for model and infrastructure limits.

Nothing in the record says this was used. What it says is that the architecture compiles, that someone built it to sell, and that the distinguishing feature is legible enough from the outside that a defender can count providers per process. That is a smaller claim than the headlines, and a more useful one.