CLOSEDQUORUM: The First Reported Autonomous AI C2 Implant

Sep 22, 2026 · Cisco Talos · WIRED · Publication

Cisco Talos detailed CLOSEDQUORUM, a Windows implant that delegates tactical command-and-control decisions to a quorum of large language models, in research enabled by CAIRN.

CLOSEDQUORUM is a Windows malware sample that polls multiple commercial LLM providers and uses their decisions to select its next actions, without requiring ongoing operator tasking. The reporting describes evidence connecting the sample’s developer to criminal forum activity, while noting that deployment in the wild has not been confirmed.

Links

• Cisco Talos Research
• WIRED Feature

• AI-integrated malware
• command and control
• malware analysis
• CAIRN