Cisco Talos Details CLOSEDQUORUM, First Reported Autonomous AI C2 Implant

CLOSEDQUORUM, a Windows malware binary discovered through Cisco Talos’ CAIRN project, exhibits fully autonomous command-and-control. It uses Google Gemini, DeepSeek, Qwen, and Mistral AI models to independently decide what actions to take during the post-compromise stages of an attack.

Talos describes it as a shift in effort displacement for attackers, where expanding portions of the attack chain run without operator involvement.