The Autonomous Threat Horizon: Cisco Talos Discovers First Multi-LLM-Driven Windows Malware

SAN JOSE, California — In what cybersecurity researchers are calling a critical architectural turning point for modern cyber warfare, Cisco Talos has publicly disclosed a groundbreaking piece of Windows malware that eliminates the human element from the command-and-control loop.

Dubbed CLOSEDQUORUM, the Go-based Windows implant breaks decades of cyberattack convention. Instead of waiting for a human operator to analyze an infected host and issue instructions, CLOSEDQUORUM autonomously queries a panel of four competing commercial large language models (LLMs)—DeepSeek, Qwen, Mistral, and Google Gemini—and uses a majority-rules voting system to dictate its next malicious move.

Disclosed in September 2026, CLOSEDQUORUM is the first publicly documented case of malware that delegates tactical decision-making directly to artificial intelligence. While the discovery stops short of a fully self-propagating worm, security experts warn that the malware fundamentally alters the economics of cybercrime, enabling threat actors to scale complex, adaptive intrusions with minimal hands-on-keyboard supervision.

Main Facts: How CLOSEDQUORUM Operates

The architecture of CLOSEDQUORUM represents a radical departure from traditional command-and-control (C2) frameworks. For decades, the speed and scale of a cyberattack have been bounded by human limitations: working hours, attention spans, and the cognitive load required to manually guide malware across multiple compromised machines.

The Multi-Model Voting Loop

Once CLOSEDQUORUM successfully executes on a target Windows machine, it begins an automated operational cycle:

1. Context Gathering: The implant profiles the host environment, collecting system data and operational context.
2. Independent Polling: The malware queries four distinct commercial LLMs—DeepSeek, Qwen, Mistral, and Google Gemini—simultaneously.
3. The Menu of Options: Each model is prompted to independently choose the malware’s next action from a rigid, predefined menu:
   • Steal: Harvest Windows credentials via LSASS memory dumping, extract saved credentials from popular web browsers (Chrome, Edge, Firefox), and siphon cryptocurrency wallet data.
   • Inject: Execute code stealthily inside the memory space of legitimate, trusted processes using advanced techniques like process hollowing or Early Bird APC injection.
   • Persist: Install mechanisms designed to survive system reboots.
   • Move: Attempt lateral movement across the local network to infect adjacent machines (though this specific module was found to be non-functional in the sample analyzed by Talos).
4. Deterministic Resolution: Each model responds in a strict JSON format. Whichever tactical option secures the majority vote is executed immediately. In the event of a voting tie, a hardcoded bureaucratic hierarchy takes over: DeepSeek’s recommendation breaks the tie, followed sequentially by Qwen and Mistral.

Exfiltration and Human Oversight

Once an action is executed, any stolen data is securely encrypted and exfiltrated via a Discord webhook directly into a channel monitored by the human operator.

Crucially, CLOSEDQUORUM is autonomous in its tactics, but not its business operations. A human attacker must still conceptualize the attack, compile the malware with their own API keys and webhook configurations, deploy the payload, and periodically review the exfiltrated loot. The AI manages the tactical micro-decisions; the human maintains strategic supervision.

Chronology of the Discovery

The uncovering of CLOSEDQUORUM traces back to telemetry anomalies identified by threat intelligence analysts, culminating in its formal documentation by Cisco Talos in September 2026.

• Early 2024–2025 (The Proliferation Phase): Threat actors increasingly adopt generative AI tools to streamline ancillary tasks. Cybercriminals use LLMs to write more convincing phishing lures, draft extortion letters, and obfuscate malicious source code. However, the core decision-making engine of live attacks remains firmly anchored to human-operated C2 servers.
• Mid-2026 (Development and Testing): An advanced threat actor develops CLOSEDQUORUM, synthesizing Go-based system administration capabilities with RESTful API calls directed at popular, publicly available AI model providers.
• September 2026 (Talos Disclosure): Cisco Talos researchers publish a detailed technical breakdown of CLOSEDQUORUM. The disclosure highlights the shift from heuristic-based or human-steered malware to decentralized, AI-consensus-driven implants. Security analysts worldwide immediately recognize the architectural shift, sparking urgent discussions regarding how traditional defense-in-depth frameworks must adapt.

Supporting Data and Technical Vulnerabilities

While CLOSEDQUORUM introduces a terrifying new paradigm in malware automation, Cisco Talos’s analysis reveals that the architecture is far from invincible. In fact, its heavy reliance on external infrastructure creates critical choke points that defenders can exploit.

The External API Dependency

Unlike traditional malware that communicates quietly with a hidden, dedicated C2 server, CLOSEDQUORUM relies entirely on live, external API calls to public AI service providers. This introduces several fatal flaws:

• Network Visibility: The malware must transmit outbound requests to well-known commercial AI endpoints.
• Rate Limits and Outages: If an LLM provider experiences an outage, institutes rate limiting, or flags the API key for abusive behavior, the malware’s decision loop stalls or crashes entirely.
• Malformed Responses: If an LLM returns unstructured text instead of the strict JSON format required by the malware, the voting mechanism fails to parse the input, potentially freezing the execution thread.

Functional Limitations

Talos researchers noted that while the "move" option (lateral movement) was present in the codebase, it was ultimately non-functional in the analyzed sample. Consequently, CLOSEDQUORUM remains restricted to a single compromised host rather than functioning as a self-propagating worm. The blast radius is currently contained to the initial point of entry—though security experts emphasize that future iterations will likely resolve these bugs.

Official Responses and Industry Reactions

The cybersecurity community has responded to the Talos disclosure with a mixture of sober analysis and urgent calls for philosophical shifts in security operations centers (SOCs).

"The meaningful change isn’t that malware used AI. Attackers have been using AI for auxiliary tasks for years. The true shift is that the decision of what to do next during an active compromise—historically the most human-dependent phase of an intrusion—has been successfully handed over to a multi-model consensus loop." — Cisco Talos Threat Intelligence Summary

Leading voices in the infosec community have pointed out that CLOSEDQUORUM reframes the labor dynamics of cybercrime. Attackers no longer need to maintain constant, hands-on-keyboard vigilance during prolonged intrusions. A single operator can theoretically manage multiple simultaneous AI-driven compromises, checking in only to harvest data and adjust strategic parameters.

Conversely, defenders are facing an uphill battle regarding detection philosophy. Because the malware interacts with legitimate, widely used AI APIs that enterprise developers access daily, traditional domain blocklists and simple signature-based alerts are rendered virtually useless. Seeing a connection to DeepSeek or Gemini is no longer an indicator of compromise; it is background noise in a modern corporate network.

Implications for the Future of Cybersecurity

The emergence of CLOSEDQUORUM forces both offensive and defensive security disciplines to evolve rapidly. The implications will redefine the daily realities of SOC analysts and threat actors alike.

For Defenders: The Pivot to Behavioral Analytics

Security teams can no longer rely on static indicators of compromise (IOCs) such as malicious IP addresses or known C2 domains. Stopping multi-LLM malware requires advanced behavioral analysis.

Defenders must look for anomalous combinations of events within a single process session. Individually, making an API call to an LLM, reading browser credentials, or creating a WMI persistence entry may not trigger high-severity alerts. However, when a single process interacts with multiple commercial AI providers while simultaneously touching sensitive memory structures like LSASS and injecting code into suspended processes, the composite pattern becomes unmistakable.

Building SOC tooling capable of correlating these disparate behavioral threads in real-time is an immense engineering hurdle. Organizations that fail to update their detection logic beyond legacy signatures will find themselves blind to autonomous threats.

For Attackers: The Democratization of Scale

For the offensive community, CLOSEDQUORUM lowers the barrier for operational scaling. Crafting the malware still requires high-level programming and systems engineering expertise; however, once deployed, the software solves the primary bottleneck of cyber operations: human attention span.

By automating tactical decisions, threat actors can conduct deeper, more persistent, and more widely distributed campaigns with significantly smaller human teams. The attacker transforms from a tactical micro-manager into an administrative supervisor.

Conclusion

CLOSEDQUORUM is unlikely to remain an isolated anomaly. As commercial LLMs become more accessible, faster, and cheaper, decentralized AI decision-making will become a standard design pattern in advanced persistent threats. The race is now on between threat groups striving to perfect autonomous, multi-model consensus loops and defensive security teams racing to build behavioral detection frameworks capable of stopping an adversary that no longer needs to sleep.