The Cisco Talos security team released a blog post on September 22, revealing an AI-based malicious software called ClosedQuorum. This malware primarily targets the Windows 11 platform and, after successfully infiltrating a user's computer, uses AI models such as Google Gemini, DeepSeek, Qwen, and Mistral to make autonomous decisions, specifically to extract the most valuable information from the attack target.
Calling Gemini, DeepSeek, and Other Models, Autonomous Decision-Making After Infiltration
Talos conducted in-depth analysis and found that after successfully infiltrating a target device, ClosedQuorum uses multiple AI models to decide the attack plan, including stealing browser login credentials, extracting cryptocurrency information, persistently executing malicious software, and spreading the malware to other devices. What is alarming is that this malware is built using the Go language and can run completely automatically without human operators issuing commands—it uses reconnaissance information and a "voting system" to determine the next attack action.
In other words, traditional malware often relies on instructions sent remotely by attackers, but ClosedQuorum entrusts the decision of "what to do next" to AI. It first assesses its current environment, then selects the most profitable or advantageous attack path based on recommendations from multiple models, with almost no human intervention required throughout the process.
The First AI-Delegated C2 Implant Program, Greatly Increased Speed and Scalability
Talos described ClosedQuorum as "the first publicly documented Windows implant program," and its uniqueness lies in delegating tactical command and control (C2) decisions to a set of AI models. The team commented that this increases the speed and scalability of malicious operations—previously, tasks such as analyzing targets and formulating attack strategies required manual work, but now these can be quickly completed by models after infiltration, allowing attackers to penetrate more devices at a lower cost.
C2 typically refers to the communication and control channel between malicious software and the attacker's server; however, ClosedQuorum transfers the "decision-making authority" within this channel to AI, meaning that even if the command server goes offline, the implanted program can continue the attack based on the information it has already obtained. This trend toward autonomy presents new challenges for traditional security defenses that rely on identifying C2 beacons through traffic characteristics.
Currently, Talos has publicly shared related technical analysis and reminded defenders to pay attention to such "AI-driven, autonomous decision-making" implant programs. For ordinary users, timely updating system patches, enabling multi-factor authentication, and being cautious with suspicious files and links remain fundamental measures to reduce the risk of being hacked and losing credentials or cryptocurrency.
