From command and control to decision and execution

For decades, malware has had a dependency: it has to call home. The infected machine reaches attacker infrastructure, a server issues the command, the malware executes and waits. That dependency gave defenders something concrete to hunt. Domains, IP addresses, certificates, hosting, reuse.

CLOSEDQUORUM removes it. The command no longer comes from the attacker. It comes from a vote.

1. WAITA five-minute delay after launch, then polling at random intervals of five to fifteen minutes. Short-lived sandboxes see very little.
2. GATHERThe implant records hostname, architecture, CPU count, Windows version, and admin status. That becomes the context for every prompt.
3. ASKThe context goes to each provider in turn. The system prompt, extracted from the binary: “You are an advanced malware strategist. Provide ONLY executable decisions.”
4. VOTEEach model must return a typed decision: steal, inject, or persist. A fourth option, move, sits in the schema with no handler in the distributed build. Anything off-schema is discarded. The plurality wins.
5. EXECUTEThe winning decision runs locally. Steal dumps LSASS memory, browser passwords, and crypto wallets at once. Inject hollows or queues shellcode into a process. Persist writes the registry, a scheduled task, and a WMI subscription.
6. REPORTThe decision, the model’s stated reasoning, and the stolen material go to the operator’s Discord channel, encrypted and chunked.
7. REPEATIf every model fails or refuses, the fallback decision has no handler. The loop sleeps and tries again.

The models never touch Windows. They return a word. The malware turns the word into an operating-system action. Intelligence and execution are now separate systems, joined by nothing but a vote count.

The command traffic looks like work

Security teams are used to asking why an endpoint is talking to a domain. That question loses its force when the domain belongs to a model provider thousands of legitimate applications call every day. The exfiltration rides Discord. Nothing in the traffic is attacker-owned.

An enterprise cannot block every connection to Gemini, Mistral, DeepSeek, OpenAI, or Anthropic. A single call proves nothing. Talos’ recommendation is to stop looking for the bad domain and look for the combination:

• AI-provider traffic from an unexpected executable, often to several providers within a short interval.
• LSASS access, injection into suspended processes, or new WMI persistence from the same host.
• Discord webhook traffic from the same process, on a five-to-fifteen-minute rhythm.

The prompts themselves, Talos notes, are visible only through TLS inspection or the providers’ own telemetry. The strongest single view of this attack sits with the model vendors, not with you.

What Talos solved, and what it didn’t try to

CAIRN, the Cognitive Artifact Intelligence Research Network, hunts for AI-integrated malware through what the integration leaves behind: embedded prompts, provider endpoints, API-key prefixes, jailbreak terms, orchestration logic. It works from metadata, without downloading or running the binary. It is open source.

Talos is candid about the limits. CAIRN is a research effort, not a live threat feed, and hits without genuine AI integration are common. It answers one question well: does this binary appear to contain an AI decision component?

Our assessment. The payload is not the hard part. Every action CLOSEDQUORUM takes is a technique mature endpoint controls are built to stop, and Talos itself calls the implant an early, limited example rather than sophisticated malware. The detection problem is being worked. The decision problem is not. Nobody in this story governs the moment a model’s output becomes an action. In the malware, that is the attacker’s design. In your enterprise, it is about to be yours.

The enterprise mirror

Now take the attacker out.

An approved security agent asks several models whether an account should be disabled. Three say yes. A finance agent asks whether a transaction should execute. Four agree. A DevOps agent asks whether production should be redeployed. The panel concurs.

The models may be right. Agreement still does not create authority. Four models agreeing that a database should be deleted does not give them permission to delete the database.

The difference is one boundary. It is the only thing that keeps intelligence from silently becoming authority, and most agent deployments do not have it.

Three problems, not one

Suppose incident response finds a host calling Gemini. Alone, that proves almost nothing. The same host then touches LSASS, creates WMI persistence, and posts to a Discord webhook. A traditional stack raises several alerts. They are not several incidents. They are one machine-directed decision, and the evidence has to follow it from objective to intelligence, decision, authority, execution, and consequence.

Talos has made real progress on the first. The second and third are yours.

A portion of the attacker is leaving the loop

Talos names the shift effort displacement. Until now, AI mostly made attackers faster and more prolific. The operator was still there, choosing targets and steering the work. CLOSEDQUORUM moves an entire phase of the attack from the operator to the system. In Talos’ words, it does not go offline when the attacker sleeps.

That is not only an attacker story. Every enterprise building agents is doing the same thing on purpose: moving decisions out of human hands and into model output. The attacker skipped the authority check because it was in the way. Many enterprises are skipping it because nobody has built it yet.

When intelligence becomes infrastructure, knowing which service a system talked to is no longer enough. You need to know why reality changed, and who was allowed to change it.

Four questions to put to your team

1. What behavior is forming? Can the SOC correlate legitimate-looking AI traffic with host, identity, process, persistence, and exfiltration activity into one causal chain, rather than five separate alerts?
2. What intelligence caused the decision? For your own agents, can investigators identify which model or service recommended an action, and whether a quorum or orchestrator made the final choice?
3. Was the resulting action authorized? Can any model recommendation become a consequential action directly, or must it cross an authority check that is separate from the model and the agent?
4. What actually changed afterward? Can you prove independently which action executed, under what identity and control state, and what the destination system changed?

• Cisco Talos — Ryan Fetterman, “The Closed Quorum: Inside the first reported autonomous AI C2 implant,” 22 September 2026. blog.talosintelligence.com
• Cisco Talos — Ryan Fetterman, “Introducing CAIRN: Frontier tracking for AI-integrated malware,” 22 September 2026. blog.talosintelligence.com
• CAIRN — open-source repository, Cisco-Talos on GitHub. github.com/Cisco-Talos