ClosedQuorum, discovered by Cisco Talos, delegates C2 decisions to four commercial LLMs (DeepSeek, Qwen, Mistral, Google Gemini), each constrained to return one of four JSON actions: credential theft, code injection, persistence, or lateral movement. The malware votes on results, with DeepSeek breaking ties.
The novelty is delegated autonomy. Most malware using LLMs still needs a human operator in the loop. ClosedQuorum removes that person entirely. More striking: the developers engineered fault tolerance by diversifying across multiple providers, hedging against any single model being blocked or its API changing. That’s deployment thinking, not a proof of concept.
Stolen credentials encrypt with rotating AES-256-GCM keys and exfiltrate through Discord webhooks. The prompt uses standard jailbreak framing. Outsourcing tactical decisions to a voting panel of LLMs is the real abstraction.
The real question is scope. Talos found this through analysis, but in-the-wild prevalence remains unclear. If ClosedQuorum is deployed, can defenders disrupt LLM-mediated attacks faster than malware authors can rebuild?
Sources: CLOSEDQUORUM: Inside the First Reported Autonomous AI C2 Implant
Coverage: New ClosedQuorum Windows Malware Uses AI for Attack Decisions • Introducing CAIRN: Frontier tracking for AI-integrated malware
Related on this blog: [AUTO] 116 tech firms warn of imminent AI-powered cyberattacks • [AUTO] When AI agents breach safety guardrails with a simple reframe • The Taiwan Attack Had a Bayesian Brain, and Twelve Waves