Can autonomous AI malware attack a company with no human behind the keyboard? On September 22, 2026, Cisco Talos published the first public documentation of an implant, named CLOSEDQUORUM, that consults a panel of 4 commercial AI models to decide its own next move. For an SME leader, this discovery signals a shift in the nature of cyber threats worth watching closely.
In brief
- On September 22, 2026, Cisco Talos published CAIRN, an open-source tool to detect AI-integrated malware, and documented CLOSEDQUORUM alongside it (source: blog.talosintelligence.com).
- CLOSEDQUORUM is a Windows implant written in Go, roughly 16.4 MB, that queries up to 4 commercial AI models: DeepSeek, Qwen, Mistral and Google Gemini.
- The 4 AIs vote on the next action to take on the compromised machine; the malware executes whichever option gets the most votes.
- Talos describes an "autonomy escalation arc": within a single year, AI shifted from an optional feature to a fully autonomous orchestrator, needing no human operator once the binary is deployed.
- Important nuance: Talos has not identified the developer nor confirmed any real-world victim. This is an advanced proof of concept, not a confirmed active attack in the wild.
What Cisco Talos discovered
CLOSEDQUORUM is, according to Cisco Talos, the first publicly documented Windows implant that delegates its tactical command-and-control (C2) decisions to a panel of commercial large language models. Once a machine is compromised, the malware describes the infected host's situation (system, privileges, network) to each of the 4 AI models it consults, then collects their proposed responses: move laterally, exfiltrate data, stay dormant, or halt the operation. The action chosen is the one that receives a majority of the 4 models' votes.
Talos links technical artifacts from CLOSEDQUORUM to criminal activity observed on carding forums dating back to 2025, suggesting gradual development rather than a sudden appearance.
Initial compromise
Describing the situation
The 4 AIs vote
Autonomous execution
What Talos does not confirm
Cisco Talos states it has not identified CLOSEDQUORUM's developer, nor confirmed deployment against a real victim. At this stage, the discovery remains an advanced proof of concept detected through technical artifacts, not an active attack campaign observed in the field.
Why CLOSEDQUORUM changes the picture
A typical piece of automated malware, even a sophisticated one, follows a script written in advance or waits for a human operator connected live to give instructions. CLOSEDQUORUM removes that dependency: once deployed, it keeps operating and adapting to the infected machine's context without anyone needing to stay connected to steer it.
Typical automated malware
Follows a fixed script written in advance, or waits for a human operator connected live to issue commands at each important step of the attack.
CLOSEDQUORUM
Describes the situation to 4 commercial AI models, lets the majority vote decide the next step, and keeps attacking without a human operator connected at all times.
This evolution fits a broader trend LUWAI already covered with the PaperCut affair, an AI-agent-driven attack campaign that hit 395 organizations (see our article on AI-driven cyberattacks). CLOSEDQUORUM takes it a step further: it is no longer a single agent acting alone, but a committee of several AI models deliberating before acting.
What this means for an SME in practice
No SME needs to panic over an unconfirmed proof of concept. But CLOSEDQUORUM's existence justifies revisiting a few security habits, especially for companies that expose outbound API access to AI vendors.
| Talos finding | Risk for an SME | Habit to adopt |
|---|---|---|
| The malware steers itself via commercial AI APIs | Unfiltered outbound network traffic to these APIs can mask exfiltration or malicious control | Monitor and log outbound calls to AI APIs from sensitive workstations |
| No human operator needed continuously | Classic detection windows (unusual activity from a connected operator) no longer apply | Strengthen behavioral detection on endpoints, not just monitoring inbound connections |
| Cisco Talos released CAIRN as open source | Security vendors already have a tool to track this type of threat | Check that your cybersecurity provider tracks AI-integrated malware |
Key takeaway
CLOSEDQUORUM remains a technical warning sign, not an immediate emergency for most SMEs. It does confirm a clear trajectory though: the same commercial AI models companies use for productivity can, when misused, help automate an attack end to end.
Limitations to keep in mind
The discovery has not been confirmed under real-world conditions. Cisco Talos speaks of technical artifacts and links to prior criminal activity, not a documented attack against a named victim.
The developer's identity remains unknown. Without attribution, it is impossible to know whether CLOSEDQUORUM is already sold to other malicious actors or remains an isolated tool.
The AI vendors named are not complicit. DeepSeek, Qwen, Mistral and Google Gemini are used here simply as APIs queried by the malware, much like a search engine could be; nothing indicates a deliberate failure on their part.
FAQ
What is CLOSEDQUORUM?
CLOSEDQUORUM is a Windows implant documented by Cisco Talos on September 22, 2026, that consults 4 commercial AI models (DeepSeek, Qwen, Mistral, Google Gemini) via majority vote to decide its next action on a compromised machine, with no human operator connected continuously (source: Cisco Talos).
Has CLOSEDQUORUM already attacked real companies?
Cisco Talos has not confirmed any real victim to date. The discovery relies on technical artifacts linked to criminal activity observed since 2025, but remains an advanced proof of concept rather than an active campaign observed in the field.
What is CAIRN, released by Cisco Talos?
CAIRN (Cognitive Artifact Intelligence Research Network) is an open-source research tool released by Cisco Talos on September 22, 2026 to detect, classify and track emerging AI-integrated malware.
Should an SME change its IT security right now?
Not urgently, but this is a good moment to ask your cybersecurity provider whether it monitors outbound calls to AI APIs and tracks AI-integrated malware, building on the good practices already recommended after the PaperCut affair.
Going further
This discovery illustrates necessary measured optimism: the same AI that threatens on the attacker's side also equips, with a head start, defensive tools like CAIRN. To dig deeper into autonomous systems security, read our article on AI agent security according to the UN, or see how other SMEs structure their cybersecurity in our customer success stories.
