On September 22, 2026, Cisco Talos published its analysis of CLOSEDQUORUM, a Windows implant that, after it lands on a machine, hands the choice of its next action to a panel of commercial large language models and then runs whatever they pick. Talos analyst Ryan Fetterman describes it as, to Talos's knowledge, the first publicly documented Windows implant to use LLMs this way for command and control. It is a 16.4MB, 64-bit Go binary. Once running, it gathers host context — hostname, OS, CPU count, Windows version, admin status — and queries up to four providers in sequence: DeepSeek, Qwen, Mistral, and Google Gemini. Each returns a vote constrained to a fixed menu — steal, inject, persist, or move, the last of which has no handler in the distribution build — and the option with the most votes wins. On a tie, the binary favors DeepSeek, then Qwen, then Mistral, then Gemini, in that order.

The steal path is the point of the operation: dumping Windows credentials from LSASS memory, lifting saved passwords from Chrome, Edge, and Firefox, and pulling data from MetaMask, Exodus, and Ethereum wallets. Stolen material is encrypted and posted to an operator's Discord webhook. Talos says it has no confirmation the malware was deployed in the wild, and the publicly available build ships with placeholder API keys and a dummy webhook, so the researchers did not observe a full end-to-end run. But artifacts in the binary tie the developer to carding-related criminal-forum postings dating to 2025. Talos discovered it through CAIRN, an open-source toolkit it released the same day for hunting AI-integrated malware.

Why the command-and-control server disappeared

Ordinary malware needs infrastructure an operator controls — a domain, an IP, a listener. That infrastructure is attributable, and it is what defenders hunt: threat feeds publish it, certificate transparency logs expose it, proxies block it. CLOSEDQUORUM removes that piece. Its instructions come from the same commercial LLM endpoints that thousands of legitimate applications call every day. There is no unique attacker domain to seize, and, as Talos puts it, the tie-break and voting logic mean the operator does not need to be online at all — the model panel runs the campaign while the attacker sleeps.

That is the structural shift worth internalizing, and it is not specific to one malware family. When a model provider's endpoint is both where your developers' legitimate AI tools go and where a credential stealer gets its marching orders, destination alone stops telling you anything. Talos is explicit that domain blocking is the wrong instinct here: legitimate software contacts DeepSeek, Mistral, Gemini, or Discord all the time. The signal is not that a machine talked to a model provider. It is which process did, alongside what else that process was doing.

The signal moved from the network edge to the endpoint

Talos's recommended detection strategy is behavioral, and it reads like a list of things you can only see on the machine itself. The indicators it names include AI-provider API traffic originating from an unexpected Windows executable; similar requests fanned out to several model providers within a short interval; Discord webhook traffic from the same process or host; and the presence of known injection, LSASS-access, or persistence behavior on the same host. No single one of those identifies the architecture. The combination does — and most of the combination lives below the network edge, on the endpoint, attributed to a process. Talos notes that the structured prompts — the "malware strategist" instruction and the host context sent with it — are likely visible only through TLS inspection or provider-side telemetry, which is precisely the depth most organizations do not have.

What security teams should check now

Start with a question most fleets cannot answer: which processes, on which machines, are reaching a model provider at all? A behavioral detection assumes you already have per-process attribution of AI egress; if you cannot see it, you cannot correlate it with anything.

Then look at correlation rather than blocklists. A developer's IDE calling one provider is normal. A single unexpected executable fanning out to several providers in a short window, on a host that is also touching LSASS or creating a scheduled-task or WMI persistence, is not — and that fused view is what turns a set of individually-innocent signals into a detection. Confirm whether your current tooling can even join "talked to a model provider" to "accessed credential memory" on the same process.

Finally, decide where a provider allowlist would actually be enforced in your stack, if anywhere — at the device network layer, in an instrumented agent runtime, or both. An allowlist that exists only as policy, with nothing enforcing it, does not narrow this surface. This is the same device-visibility gap behind the CoSnitch Copilot flaw and the Kriminal jailbreak-wrapper — a consumer or unexpected tool talking to a model provider from a machine nobody is watching.

How Waxell handles this

The precondition CLOSEDQUORUM relies on — a process on a real machine reaching a commercial model provider, invisible to the security team — is the gap Waxell Endpoints exists to close. Endpoints discovers the AI applications running on enrolled devices and attributes their outbound AI traffic per process, per user, and per provider host by reading the plaintext hostname in the TLS handshake, without decrypting anything. That produces exactly the primitive Talos's guidance assumes you have: an answer to "which executable on this laptop just contacted a model provider, and when." Under policy, Endpoints can leave an app observe-only, block it at the network layer before data leaves the machine, or — only when an admin turns it on, per host — capture with secrets and PII redacted on the device. Its catalog spans 60+ AI provider domains and auto-syncs, and it deploys fleet-wide through Hexnode, Jamf, Kandji, Mosyle, or Intune, or by manual single-machine install.

Where Endpoints sits in the CLOSEDQUORUM story needs stating precisely, because the honest limits are the point. In its default posture Endpoints reads the hostname, not the prompt, so it does not see the "advanced malware strategist" instruction or the vote — short of the per-host, opt-in capture mode, which terminates TLS only for catalog AI providers, the content signal Talos says needs TLS inspection or provider telemetry stays outside what Endpoints observes. Its catalog is curated: a process talking to a provider not yet in the catalog surfaces as ungoverned rather than attributed, which is itself useful but is not the same as identifying it. It covers enrolled machines; unenrolled ones stay invisible. And it is not an EDR — it supplies one of Talos's correlated signals, the AI-provider-from-an-unexpected-process one, not the fused detection that also weighs the LSASS access and the injection. What it gives you is the inventory, the per-process attribution, and a network-layer block if you want one — the first control, and the one most fleets are missing. Waxell also cites an average of $670,000 added to breach costs specifically from shadow AI, the same class of unseen egress this incident rides on.

FAQ

What is CLOSEDQUORUM?

CLOSEDQUORUM is a Windows implant documented by Cisco Talos on September 22, 2026. After it is deployed, it queries up to four commercial LLM providers — DeepSeek, Qwen, Mistral, and Google Gemini — which vote on its next action from a fixed menu of choices — steal credentials and wallets, inject code, establish persistence, or move, the last of which has no handler in the distribution build — and it executes the winning choice without a human operator. Talos calls it, to its knowledge, the first publicly documented Windows implant to use LLMs this way for command and control.

Has CLOSEDQUORUM been used against real targets?

Talos says it has no confirmation of in-the-wild deployment, and the public build shipped with placeholder API keys and a dummy webhook, so Talos did not observe a complete end-to-end run. It did, however, tie artifacts in the binary to carding-related criminal-forum postings dating to 2025.

Why doesn't blocking the AI providers' domains stop this?

Because the same provider endpoints are called by legitimate software all day. Talos's own guidance is that domain blocking is the wrong control here and that detection should be behavioral — looking at which process is making the calls, whether it is fanning out to several providers at once, and what else that process is doing on the host, such as accessing credential memory or creating persistence.

Would Waxell have detected CLOSEDQUORUM?

Not on its own, and it is worth being precise. Waxell Endpoints addresses the precondition, not the full detection: it attributes per-process AI-provider traffic on enrolled devices by hostname and can block an app at the network layer. In its default posture it reads the connection, not the prompt or the vote, so it supplies one of the several correlated signals Talos recommends — not the fused endpoint detection that also weighs LSASS access and process injection.

What is CAIRN?

CAIRN is the open-source toolkit Cisco Talos released alongside the CLOSEDQUORUM writeup for hunting, classifying, and tracking AI-integrated malware. Talos says it works from file metadata and cognitive artifacts — embedded prompts, provider endpoints, orchestration logic — rather than by running the sample, and CLOSEDQUORUM is the first result it is publishing from it.

Sources

Cisco Talos (Ryan Fetterman), "The Closed Quorum: Inside the first reported autonomous AI C2 implant" — September 22, 2026

The Register (Jessica Lyons), "Windows CLOSEDQUORUM malware uses AI models to autonomously select post-compromise actions" — September 22, 2026

Help Net Security (Sinisa Markovic), "Researchers uncover malware that uses AI to choose its next move" — September 22, 2026

IBM, "2025 Cost of a Data Breach: Navigating AI" — 2025

Your fleet is already talking to model providers all day — the question is which processes, on which machines. Waxell Endpoints discovers the AI running on every enrolled device, attributes its provider traffic by hostname, and blocks what you decide shouldn't be there. Map the model-provider egress on your fleet.