The Closed Quorum: Inside the first reported autonomous AI C2 implant
Cisco Talos discovered CLOSEDQUORUM, the first autonomous AI-driven malware C2 implant using multiple LLMs for independent decision-making.
Cisco Talos has identified CLOSEDQUORUM, a Windows malware implant that utilizes a panel of four commercial LLMs for autonomous command-and-control decisions, removing the need for continuous human operator input. This represents a shift towards 'effort displacement' in offensive AI, enabling the malware to execute attack phases independently. The researchers also released CAIRN, an open-source toolkit designed to hunt and classify AI-integrated malware.
75