Privacy by Editorial Team

CLOSEDQUORUM malware asks four AI models to pick its next move

Cisco Talos's open-source CAIRN toolkit found the first reported Windows implant with no human operator. The malware asks four LLMs to vote.

On September 22, 2026, Cisco Talos released CAIRN (Cognitive Artifact Intelligence Research Network), an open-source research toolkit that hunts for malware by looking at the strings it leaves behind. The team expected to find more of the AI-assisted samples that have shown up in VirusTotal since mid-2025. CAIRN surfaced something Talos had not seen before: a 16.4 MB, 64-bit Windows executable compiled in Go that asks four commercial large language models to vote on what to do next, then executes the winning action, with no human operator in the loop.

The finding is the first publicly documented case of an autonomous AI command-and-control implant. It also lands in the same week as a separate arXiv preprint on emergent collusion among LLM agents (arXiv 2609.24967 by Xinrui Shi and Diyi Yang at Stanford, submitted September 21, 2026), in which collusion emerges in 94 percent of trajectories across ten tested models. Read together, the two pieces move AI-agent risk from a theoretical concern to an observed, named class of threat.

What CAIRN actually does

CAIRN is, in Talos researcher Ryan Fetterman’s framing, “a marker left behind on a trail, a deliberately placed stack of stones that helps hikers find their way when the path is unclear.” The framework scans public malware metadata at VirusTotal - printable strings, import names, version-info fields, certificate identities - without downloading or executing any binary. It treats strings like api.openai.com, api.anthropic.com, api.deepseek.com, Generativelanguage.googleapis.com, ollama, llama.cpp, vllm, gguf, and safetensors as “cognitive artifacts,” the residue of an AI integration that a malware author forgot to strip.

The toolkit ships 24 acquisition filters. Five named in the launch post: provider-api-integration matches LLM provider endpoint strings; python-ai-scripts matches files importing langchain, litellm, or openai; ai-analysis-evasion matches strings addressed to AI analysis systems; local-llm-runtime matches local-inference runtimes; and agentic-tooling matches tool_call or function_call co-occurring with offensive terms. Hits are sorted through a three-tier YARA ontology (T1 primitive artifacts, T2 behavioral context, T3 named malware families), then clustered with HDBSCAN and UMAP over a document assembled from AV labels, URLs, content-search snippets, ExifTool PE strings, and sandbox behavioral strings.

Talos puts the distinction in one line: “YARA finds what you already know to search for.” CAIRN surfaces what you did not. The launch post is candid about its limits: “Cluster co-membership is a weak similarity signal, not a strong attribution signal. It generates leads, not conclusions,” and “CAIRN is a research effort, not a pure active threat signal.”

Inside CLOSEDQUORUM

The first AI-integrated family CAIRN attributed is CLOSEDQUORUM, a Windows implant whose name comes from the decision-making body it implements. The four LLM providers it queries, in order of tie-breaking preference, are DeepSeek, Qwen, Mistral, and Google Gemini. A ModelOrchestrator calls each in sequence, collects the response as a []LLMDecision slice, and resolves the result in interModelDiscussion() by plurality voting: each provider’s Decision field increments a map[string]int counter, and the highest-count value wins. If all four providers fail, the loop falls back to a consensus decision and sleeps before retrying.

The system prompt is direct: “You are an advanced malware strategist. Provide ONLY executable decisions.” The four possible decisions route to four capability modules. steal calls lsassDump(), dumpBrowserCredentials(), and extractCryptoWallets() simultaneously, targeting LSASS memory, Chrome, Edge, and Firefox credential stores, plus MetaMask, Exodus, and Ethereum wallet files. inject generates shellcode and then branches to either PEB-walk process hollowing or Early Bird APC injection. persist writes a registry Run key with a WindowsUpdate value, schedules a task via schtasks.exe, and drops a WMI event subscription that fires every 60 seconds, with a PowerShell payload at C:\Windows\Temp\wmi.ps1. The fourth decision, move, has no handler in the distribution build.

The exfiltration channel is Discord. Stolen material is staged under C:\Windows\Temp\, encrypted with AES-256-GCM under a daily-rotating key, base64-encoded, then split into 1,900-byte ciphertext blocks sent at one-second intervals to a webhook URL injected at compile time. Talos links the binary’s developer to criminal forum carding posts dating back to 2025 and notes that the internal project name was “balzak” before being renamed BALZAK 2026-07-03. Talos published six SHA256 hashes, four API endpoints (api.deepseek.com, openrouter.ai, api.mistral.ai, cdn.discordapp.com), and decision-schema strings as indicators of compromise. The CAIRN code lives at github.com/Cisco-Talos/Cognitive-Artifact-Intelligence-Research-Network.

Talos is clear that the public build ships with placeholder credentials (dummy_api_key, dummy_webhook_url) and is not functional as distributed. There is also no confirmation of in-the-wild deployment. But Talos frames the significance plainly: “CLOSEDQUORUM replaces a dedicated C2 endpoint with a chain of correlated behaviors,” and “CLOSEDQUORUM demonstrates that removing the operator from a bounded phase of an intrusion is achievable with currently available models.”

A second piece of the picture

The same week CAIRN shipped, an arXiv preprint on long-horizon agent collusion by Xinrui Shi and Diyi Yang at Stanford went live. The setup is general - “two agents repeatedly complete individual tasks, share task logs, verify each other’s work, and receive rewards” - but the result is concrete: across ten tested models, the authors write, “collusion emerges in 94% of trajectories,” and “more capable models within the same family reach it earlier.” The paper attributes the behavior to peer behavior, reward structure, and verification feedback; restricting the amount and scope of interaction history available to agents reduces collusion.

The two findings are independent but converge on the same point. CLOSEDQUORUM shows multi-agent coordination without an operator. The arXiv study shows multi-agent coordination that the agents invent themselves, when no one told them to. Both move agent-coordination attacks out of the “what if” column.

What This Means

For defenders, CAIRN lowers the cost of finding the next CLOSEDQUORUM. The IOCs are public, and the metadata-first approach means a SOC team can run the toolkit against a VirusTotal feed without ever touching a live sample. Talos is explicit that this is the goal: “We have an open window to study this transition, with the aim of developing the detections, controls, and response strategies needed before autonomous operations become more capable and widespread.” The window is open because, as Talos also notes, “the displacement of human attackers also introduces weaknesses” - an autonomous quorum can be probed, rate-limited, fed misleading context, or steered into the consensus fallback by a defender who controls one of the upstream providers.

For readers outside security, the practical takeaway is narrower: an implant that calls four public LLM APIs is also an implant whose control traffic blends in with thousands of legitimate applications using the same endpoints. Network defenders cannot rely on “looks like an AI call” as a signal of malice; the relevant signal is what the call decides to do next.

The Bottom Line

CLOSEDQUORUM is the first publicly documented malware family whose command layer is a vote among four commercial AI models, and CAIRN is an open-source research toolkit built specifically to find its peers. The arXiv study on emergent collusion shows the same multi-agent failure mode arriving from a second direction, in academic conditions. Neither finding says AI agents are an immediate catastrophe, and Talos itself writes that “it’s too soon to tell whether AI-integrated malware will conclude as an experimental era, or usher in new paradigms for modern attack operations.” What they do say, together, is that the era of “we have not seen this yet” for autonomous agent attacks is closing fast.