Cisco Talos published two companion research releases on 2026-09-22: 'Introducing CAIRN: Frontier tracking for AI-integrated malware' and 'The Closed Quorum: Inside the first reported autonomous AI C2 implant.' CAIRN (Cognitive Artifact Intelligence Research Network) is an MIT-licensed, open-source Python toolkit (github.com/Cisco-Talos/Cognitive-Artifact-Intelligence-Research-Network) that hunts, classifies, and tracks 'AI-integrated malware' -- malware that, in Talos's own definition, 'functionally operationalizes, explicitly targets, or exploits AI systems and their ecosystems' -- entirely from VirusTotal Intelligence scan metadata, without downloading or detonating binaries. It runs 24-27 acquisition filters (provider-api-integration, python-ai-scripts, ai-analysis-evasion, local-llm-runtime, agentic-tooling, and Chinese-provider-specific filters for BigModel/Qwen/ERNIE, among others) to pull candidate samples, then classifies them through a three-tier YARA ontology (26 total rules): Tier 1 (9 rules) flags primitive artifacts such as hardcoded LLM API endpoints, key prefixes, and prompt-instruction residue; Tier 2 (8 rules) flags behavioral co-occurrence such as shell access paired with LLM calls, or evasion paired with offensive tradecraft; Tier 3 (9 rules) performs confirmed family-level attribution. CAIRN supplements this with embedding-based semantic clustering (UMAP/HDBSCAN) to surface samples that share no string overlap, and stores findings in a local SQLite corpus with a graph-explorer UI. Using this pipeline, Talos catalogued 10 confirmed AI-integrated malware families across 11 behavioral archetypes, including CLOSEDQUORUM (A4, LLM-Tasked C2), PROMPTLOCK (A1, LLM-directed payload generation, Go/Lua), HONESTCUE (A1, .NET), TEAMPCP (A5, LLM infrastructure supply chain, Python/npm), LAMEHUG (A6/A7, credential harvester, Python), PROMPTSTEAL (A6), QUIETVAULT (A6+A8, npm SDK malware), FRUITSHELL (A3, AI-analysis evasion, PowerShell), GUARDBREAKER (A3, VBScript), and PROMPTFLUX (A1, VBScript). Talos frames the corpus as evidence of an 'autonomy escalation arc' spanning roughly one calendar year: CERT-UA's July 2025 disclosure of LAMEHUG (Qwen2.5-Coder via Hugging Face, generating Windows recon/exfiltration commands for APT28-linked phishing) established single-model, execution-time LLM tasking; ESET's August 27, 2025 disclosure of PROMPTLOCK (Go/Lua, a locally-hosted Ollama gpt-oss:20b model generating cross-platform ransomware Lua scripts on the fly) and Google GTIG's August 2025 identification of QUIETVAULT (a JavaScript/npm credential stealer that weaponizes on-host AI CLI tools to recursively hunt for wallet and secret files before exfiltrating via a public GitHub repo) extended this to autonomous code-generation and autonomous secondary-discovery, respectively; Google GTIG's November 5, 2025 disclosure of PROMPTFLUX (a VBScript dropper whose 'Thinking Robot' module queries the Gemini API hourly for fresh obfuscation/evasion code, self-rewriting to the Windows Startup folder) added autonomous self-modification. CLOSEDQUORUM, compiled roughly seven months later, is the terminus of that arc: it removes the LLM from an on-demand tool role entirely and installs it as the standing tactical decision-maker.

CLOSEDQUORUM (renamed from an earlier internal designation, BALZAK, on 2026-07-03) is that end state. It is a 16.4MB, 64-bit Go-compiled Windows executable that Talos characterizes as the first publicly documented implant to delegate tactical C2 action selection to a panel of commercial LLMs rather than to a human operator or an attacker-run C2 server. On execution, after a 5-minute initial delay and thereafter on randomized 5-15 minute polling cycles, the implant gathers host context (hostname, OS architecture, CPU count, Windows version, administrative privilege state, and current target process) and substitutes it into a `TARGET:%s` prompt template. It queries up to four providers -- DeepSeek, Qwen (accessed via the openrouter.ai proxy rather than a direct Alibaba endpoint), Mistral, and Google Gemini -- each primed with the system prompt 'You are an advanced malware strategist. Provide ONLY executable decisions.' Each provider must return a response conforming to a strict JSON schema constrained to a small decision vocabulary; the implant tallies responses and the plurality winner executes, with ties broken by a fixed priority order (DeepSeek > Qwen > Mistral > Gemini). The decision space comprises: `steal` (simultaneous LSASS memory dumping via SeDebugPrivilege + MiniDumpWriteDump, browser credential theft from Chrome/Edge Login Data and Firefox logins.json, and cryptocurrency wallet theft from MetaMask's Chrome-extension storage plus Exodus and generic Ethereum wallet files); `inject` (operator/model-selectable Early Bird APC injection -- suspend a process, write shellcode, queue it via NtQueueApcThread, resume -- or classic process hollowing of a suspended process's image base); `persist` (Windows Registry Run-key creation under a `WindowsUpdate` value name, a `schtasks.exe`-created scheduled task, and a permanent WMI `__EventFilter` subscription named `WindowsUpdateFilter` that re-triggers a dropped `C:\Windows\Temp\wmi.ps1` PowerShell script every 60 seconds); and `move` (present in the schema but unimplemented) plus a `consensus` fallback that triggers a sleep/retry when no clear plurality forms. Collected artifacts are staged under `C:\Windows\Temp\` before being AES-256-GCM encrypted (key derived from the current date), Base64-encoded, split into 1,900-byte chunks, and posted at one-second intervals to an operator-specific Discord webhook, which also serves as a live channel for reporting the LLM panel's chosen action back to the operator. For defense evasion, the implant overwrites `EtwEventWrite` with a single RET instruction to suppress ETW telemetry, keeps a secondary payload encrypted with a time-derived key (recoverable only within an expected temporal window), and uses its randomized polling delay specifically to reduce exposure to short-lived sandbox analysis; persistence artifact names are deliberately styled to masquerade as legitimate Windows Update activity.

Critically, the publicly available distribution build ships with placeholder credentials (`dummy_api_key`, `dummy_webhook_url`); real provider API keys and a real Discord webhook URL are injected per-operator at compile time via Go linker flags (`-ldflags`), consistent with a credentials-as-a-service distribution model. Talos found no confirmation of in-the-wild deployment. Attribution is limited: development-build compilation artifacts cluster within an approximately 7-day window in mid-June 2026, and separate developer-linked criminal-forum posts discussing carding activity date to 2025, but no named threat actor, intrusion set, or nation-state sponsor is identified -- this is assessed as financially motivated crimeware infrastructure, not espionage tradecraft. Talos explicitly frames CLOSEDQUORUM as evidence of 'effort displacement': unlike prior AI-malware coverage that used a single model to augment attacker speed or scale (e.g., LAMEHUG), CLOSEDQUORUM removes the human-in-the-loop bottleneck entirely, enabling continuous, unattended, self-directed operation. For detection, Talos recommends correlating anomalous multi-provider LLM API traffic (bearer tokens presented to four competing vendors from one process within a short window, on a fixed 5-15 minute cadence -- described as having 'no benign analogue') with simultaneous LSASS access, process injection, persistence changes, and Discord webhook communication; CAIRN's own YARA detection keys on unstripped Go symbols (`main.interModelDiscussion`, `main.lsassDump`) and the hardcoded system-prompt string. A BeaconBeagle domain/config search against the implant's Discord CDN indicator (cdn.discordapp.com) returned zero matches, consistent with Talos's finding that CLOSEDQUORUM uses no dedicated attacker-controlled C2 infrastructure at all -- every network touchpoint is a legitimate commercial SaaS endpoint (LLM provider APIs, Discord CDN), which is itself the core detection challenge the CAIRN release is meant to address.