Cisco Talos Discloses First Fully Autonomous AI Command-and-Control Implant

Traditional malware relies on a tether to a command-and-control server, waiting for a human operator to dictate its next move across a compromised network. A newly discovered Windows implant named CLOSEDQUORUM severs that connection entirely, delegating its tactical decisions to a voting panel of four commercial artificial intelligence models. Discovered by Cisco Talos researchers and detailed on September 22, the architecture represents the first publicly documented instance of fully autonomous AI command and control. Rather than accelerating an attacker's workflow, the mechanism displaces the human entirely, allowing the software to operate indefinitely without active oversight.[2][3][5]

Once deployed on a target machine, the binary does not phone home for instructions. Instead, it queries a quorum of four large language models—DeepSeek, Alibaba's Qwen, Mistral, and Google Gemini—via their application programming interfaces. The implant provides the models with basic host context, such as the operating system version and administrator privileges, and instructs them to act as an "advanced malware strategist." To prevent the models from generating unusable text, the prompt forces them to "provide ONLY executable decisions," constraining their responses to strictly formatted JSON objects.[5]

The models are presented with a constrained decision space, typically voting on actions categorized as "steal," "inject," or "persist." The malware tallies the responses and executes the action that receives the majority vote. The available modules focus heavily on credential and cryptocurrency theft, mapping to specific internal functions like lsassDump(), dumpBrowserCredentials(), and extractCryptoWallets(). By collapsing the attack phase into a multiple-choice vote, the developer ensures the models provide actionable reasoning rather than open-ended text.[2][5]

In the event of a tied vote, the system does not halt or ask a human for clarification. It defaults to a predefined hierarchy built into the code: it favors DeepSeek's decision first, followed by Qwen, Mistral, and Gemini. This fallback mechanism also triggers if a preceding model refuses the prompt due to safety guardrails, becomes unavailable, or returns an invalid JSON object. The redundancy ensures the implant can continue operating even if one commercial provider patches its safety filters to block the prompts.[5]

After a decision is executed, the implant establishes a one-way reporting channel. The models' reasoning, alongside attack telemetry, is transmitted to an attacker-controlled Discord server via a webhook. Any stolen files are encrypted using the AES-256-GCM standard with a key derived from the current date. The encrypted data is then encoded in Base64, divided into 1,900-byte segments, and posted to the Discord channel at one-second intervals, creating a decentralized and highly resilient exfiltration route.[2][5]

Cisco Talos researchers identified the implant using CAIRN, a newly released open-source toolkit designed to hunt for artifacts left by AI-integrated software. While the analyzed binary contained placeholder API keys and a dummy webhook—indicating it is likely a development kit rather than an active threat in the wild—artifacts within the code connect the developer to criminal forum posts dating back to 2025. The researchers believe the architecture is intended to be sold as a service, with individual operators inserting their own API keys at compile time.[2][5]

The discovery highlights a structural shift in how offensive cyber operations scale. "Effort displacement compounds the effects of speed and scale because the human-in-the-loop is no longer the bottleneck," Cisco Talos security researcher Ryan Fetterman wrote in the disclosure. Because human operators are bound by working hours, attention spans, and cognitive load, an AI system capable of executing a phase of the attack chain can continue operating while the attacker sleeps. The session remains active, but no humans are required to maintain it.[2][5]

Defending against autonomous implants requires shifting focus from known command server addresses to behavioral patterns. Because CLOSEDQUORUM replaces a dedicated endpoint with a chain of correlated behaviors, defenders must look for distinct combinations: AI-provider API traffic originating from an unexpected Windows executable, multiple requests sent to different model providers within a short interval, and the suppression of system telemetry. As commercial models become more capable, identifying these cognitive artifacts will increasingly define the next generation of network defense.[1][2][4]