First ‘autonomous AI C2 implant’ uses panel of models to vote on next task

Cisco Talos researchers said they discovered the first reported “autonomous AI C2 implant,” which uses a four-model panel consisting of DeepSeek, Alibaba’s Qwen, Mistral and Google’s Gemini to decide on its next malicious action.

The implant, dubbed CLOSEDQUORUM, was revealed in a report published Tuesday; the malware was discovered using Cisco Talos’ open-source Cognitive Artifact Intelligence Research Network (CAIRN) tool, which was also unveiled Tuesday.

CLOSEQUORUM is a Windows implant focused on credential and cryptocurrency theft. Rather than using traditional command-and-control (C2) architecture, in which the malware connects to an external attacker-controlled domain to receive tasks directed by a human attacker, CLOSEQUORUM is designed to connect to four different commercial large language model (LLM) APIs, providing prompts that instruct the models to vote on a specific set of post-exploitation actions.

The models are told they are an “advanced malware strategist” and instructed to “provide ONLY executable decisions,” constraining their responses to typed JSON objects that the malware then processes as votes for actions such as “steal,” “inject” and “persist,” Cisco Talos Security Researcher Ryan Fetterman wrote in the report.

Each possible action corresponds to a malware module with specific functions: for example, the “steal” action runs the implant’s lsassDump(), dumpBrowserCredentials() and extractCryptoWallets() functions. The malware runs whichever action receives the most votes; in case of a tie, it favors DeepSeek first, then Qwen, Mistral and Gemini in that order if the preceding tie breakers refuse, become unavailable or don’t return the expected JSON object.

The models’ decisions and reasoning output, as well as attack telemetry, are sent to the attacker’s Discord server via a webhook; stolen data is also sent to the attacker’s Discord after being AES-256-GCM encrypted and base64 encoded.

Cisco Talos could not confirm whether the implant was actively deployed in the wild, as the discovered binary contained placeholder API keys for the model providers as well as a placeholder Discord webhook URL. The researchers believed the “LLM-as-C2 architecture” set-up is intended to be provided by its developer as a service to other cybercriminals, with each individual operator’s API keys and Discord webhooks added to the implant at compile time.

The use of legitimate services such as commercial AI providers and Discord makes domain blocking an impractical defense; instead, the researchers recommended focusing on a combination of behaviors to detect similar threats, such as AI-provider API traffic originating from an unfamiliar Windows executable, similar requests going out to several models in a short time period and Discord webhook communication from the same process or host combined with known malware techniques such as process injection.

Cisco Talos concluded that autonomous LLM-based C2 decision-making operations add a new dimension to AI-driven attacks beyond just scale and speed: it significantly reduces the need for manual operator effort, allowing an attack to run unattended and uninterrupted indefinitely.

“Effort displacement compounds the effects of speed and scale because the human-in-the-loop is no longer the bottleneck. Human operators are bound by attention, working hours, and cognitive load. An AI system capable of executing a phase of the attack chain can continue when the operator is no longer watching. It does not go offline when the attacker sleeps,” Fetterman wrote.

However, this setup also poses challenges for attackers, especially due to its reliance on commercial API providers. Model refusals, rate limits, malformed outputs and account takedowns can ultimately slow down or halt the attack entirely.

“Autonomy does not make the implant infallible; it exchanges some human limitations for model and infrastructure limitations,” the report concluded.