The CLOSEDQUORUM implant analysed by Cisco Talos picks its next move by plurality vote among four AI providers
Cisco Talos published an analysis on September 22, 2026 of a Windows implant called CLOSEDQUORUM. On every cycle the malware puts the same situation to DeepSeek, Qwen, Mistral and Google Gemini, then executes whichever decision collects the most votes. Talos also states plainly that it has no confirmation of in-the-wild deployment.
A 16.4 MB sample written in Go that outsources its own decisions
The Cisco Talos Intelligence Blog published "The Closed Quorum: Inside the first reported autonomous AI C2 implant" on September 22, 2026, authored by Ryan Fetterman. According to the analysis, CLOSEDQUORUM is a 16.4 MB 64-bit Windows executable, written in Go and built with CGO_ENABLED=1 so that C code is compiled in as well. Talos describes the implant as, to its knowledge, the first publicly documented Windows implant to apply this model to tactical command and control; Help Net Security, reporting the same day, relays that characterisation from Talos.
Talos includes its own caveat in the write-up, stating that it does not have confirmation of in-the-wild deployment. In the binary examined, every LLM API key is dummy_api_key and the Discord webhook is dummy_webhook_url, so the sample is non-functional as distributed. On Talos's assessment the developer builds a separate executable for each operator, injecting that operator's webhook and API keys at compile time; Talos presents this not as a confirmed finding but as an inference drawn from development builds. Artefacts extracted from the binary link the developer to carding-related crime forum posts going back to 2025; their identity, nationality and the forum they operate on are not disclosed. How the implant reaches victims, meaning the initial infection vector, does not appear in either source.
A quorum, a vote counter and a tie-breaking order of precedence
Talos reports that the implant queries up to four LLM provider integrations in sequence and tallies the answers by plurality vote: each provider's Decision field increments a map[string]int counter, and the decision with the highest count is executed. The providers are DeepSeek, Qwen, Mistral and Google Gemini. In a tie the order of precedence runs DeepSeek, Qwen, Mistral, Gemini; Talos writes that "If DeepSeek failed and isn't in the quorum, Qwen's vote is the deciding vote"; the order continues down the list, and Help Net Security reports the same sequence. The system prompt reads 'You are an advanced malware strategist. Provide ONLY executable decisions.' and each run writes the machine name, operating system architecture, CPU count, Windows version and administrator privilege status into a TARGET field. Help Net Security writes that the models are offered three options: steal data, inject code or establish persistence. The decision schema Talos documents has four values: steal, inject, persist and move, the last of which has no handler in the distribution build. If every model fails, the fallback decision is "consensus"; because no capability handler matches that string, the loop sleeps and retries instead of taking a default action.
The target list looks like a conventional stealer. Talos lists Windows domain and local credentials via an LSASS memory dump (the lsassDump() function), passwords saved in Chrome, Edge and Firefox, the MetaMask Chrome extension, Exodus (exodus.wallet) and Ethereum wallets. Stolen data is encrypted with AES-256-GCM under a daily rotating key, Base64 encoded, split into 1,900 byte chunks and sent to Discord one second apart. Persistence uses a WindowsUpdate value written under the current user's Registry Run key, scheduled tasks created with schtasks.exe, and WMI event subscriptions that trigger PowerShell every 60 seconds. A five-minute initial delay and randomised polling intervals of 5 to 15 minutes reduce the chance of being caught by short-lived sandbox analysis. Talos also publishes six SHA256 hashes taken from the developer's build chain as indicators of compromise.
When the decision logic is not in the file, hunting for signatures is not enough
The defensive consequence of this design is straightforward: the logic that picks the next action is not embedded in the binary, it arrives from outside models on every cycle. That is why Talos recommends focusing on behavioural signatures, specifically API calls to multiple AI providers seen alongside LSASS access, injection into suspended processes or WMI persistence. The use of Discord as an exfiltration channel is documented separately in the analysis. Talos has released its open-source research toolkit for tracking AI-integrated malware as CAIRN at github.com/Cisco-Talos/Cognitive-Artifact-Intelligence-Research-Network. Help Net Security explains that CAIRN analyses samples from file metadata without executing them, described as no downloading and no running of the malware, and sorts findings into three tiers: tier one confirms the presence of AI-related strings, tier two adds behavioural context and catches combinations that point to operational AI integration, and tier three covers verified, named malware families. Fetterman is quoted saying CAIRN "uses four distinct analysis strategies", each suited to a different phase of an investigation.
This is not an isolated case either. Help Net Security points to LAMEHUG, reported by CERT-UA in July 2025, as the earliest known example of AI-integrated malware. We covered a comparable shift in the software supply chain in our September 13, 2026 article on the RubyGems agent swarm. The unknowns deserve the same clarity: the sale price, any rental model and the number of operators with custom builds are not stated; with no confirmation of in-the-wild deployment, the victim count, affected sectors and geographies are unknown; whether DeepSeek, Qwen, Mistral or Google has commented on the abuse, closed accounts or restricted API access does not appear in the sources; how many samples CAIRN has scanned so far and how many reached tier three is not given; and whether a non-Windows version exists for macOS or Linux is not mentioned. Nor could an explicit statement about Snort or ClamAV product coverage be verified in these two sources.
The sources contain no finding related to Türkiye
Let us say this up front: neither the Cisco Talos analysis nor the Help Net Security report mentions Türkiye, a Turkish-speaking target audience or any regional targeting finding. Neither source addresses geographic targeting at all. The only country connection in the sources is the attribution to CERT-UA, which reported LAMEHUG in July 2025. This article therefore makes no claim of impact in Türkiye and draws no link to a local case.
What can be said as general risk commentary is this: the implant's target list includes passwords saved in Chrome, Edge and Firefox, and the browsers of employees at small and mid-sized companies in Türkiye often hold site admin panel passwords and active sessions. If such a sample lands, the first thing lost may not be the mailbox but administrative access to the company website. That is an inference resting on the target list Talos published; the sources contain no measurement, case or statistic specific to Türkiye. The practical takeaway is modest: not saving admin panel passwords in the browser, protecting panel access with a second verification step and keeping administrator sessions short cuts out a meaningful share of the damage an implant like this could do.
The UNALSOFT view
The business-side meaning of this story is that once AI moves to the deciding side, the attacker's logic can no longer be looked for inside the file. For small and mid-sized businesses in Türkiye the practical version is simple: the site's admin panel, the hosting panel and the company mailbox are only as secure as the passwords stored in employees' browsers. In our web design work we raise this at the start, separating panel access into per-person accounts, avoiding a single shared administrator password and keeping publishing rights narrow. Because the sources hold no measurement or case specific to Türkiye, everything written here is general risk assessment rather than a local connection to this incident.
Is your site's admin panel only as secure as a password saved in one employee's browser?
Let's review panel access, role separation and your publishing flow together. A short conversation is enough to start.