CLOSEDQUORUM Autonomous AI Malware

Cisco Talos documented the first known malware that makes its own attack decisions by polling four different AI models and going with majority vote.

CLOSEDQUORUM does not phone home to a human operator. It queries DeepSeek, Qwen, Mistral and Gemini in sequence, uses plurality voting to decide its next move, then executes on its own: stealing credentials, injecting into processes, establishing persistence. Results get exfiltrated through Discord webhooks.

For years, security teams built detection models around the assumption that a human somewhere had to approve the next step. That assumption is what made command and control infrastructure a chokepoint you could watch, block, or take down. An implant that queries a committee of language models for permission removes that chokepoint entirely. There is no operator to catch in the act, no C2 server to seize.

This does not mean every attacker will pivot to LLM-driven malware overnight. Multi-model voting adds latency and cost, and defenders will build countermeasures of their own, including watching for the exact API traffic patterns this kind of implant produces. But the direction is clear. The skill floor for building autonomous, adaptive malware dropped, and detection strategies built for human-directed threats will need to account for adversaries that no longer need a human in the loop.

What would your incident response playbook miss if the attacker on the other end was not a person?