CLOSEDQUORUM puts its next action to a vote of four commercial LLM providers

Four models are queried in sequence, their independent verdicts tallied, and the action with the most votes is executed ^[8]. A plurality carries it, and the panel is up to four providers ^[7]. With four active voters and no majority threshold, an action can win on two votes; with one provider's key compiled in, a single model's output decides ^[1]. Talos found that development builds inject provider credentials at build time, so the number of voters is set by whoever compiles the binary ^[9].

The C2 design is the part that changes defensive work. Talos describes conventional C2 as attacker-run infrastructure, a domain, an IP, a protocol and a listener, all of it attributable, blockable and expensive to rotate ^[13]. CLOSEDQUORUM instead treats the LLM providers as the C2 infrastructure ^[12], so the implant's outbound tasking traffic goes to DeepSeek, Qwen, Mistral and Google Gemini ^[7]. Those are services many enterprises already permit.

The framing Talos uses separates this from the AI-offense reporting of the past few years. Speed and scale left the operator in place. The human still directed the tooling, selected targets and guided execution ^[14]. Effort displacement moves an entire phase off the operator and onto the system, so attention, working hours and cognitive load stop setting the pace ^[15]. "It does not go offline when the attacker sleeps," Talos wrote of a system able to execute a phase of the attack chain ^[16].

The hunting method published with the finding runs on metadata alone, without downloading or executing the binary, and applies up to 24 acquisition filters across extracted strings, sandbox behaviour and antivirus detection labels ^[20][21]. The filters look for LLM provider endpoints, local inference runtimes such as ollama and llama.cpp, and tool-call syntax co-occurring with offensive capability terms ^[22]. Talos argues attackers building AI-integrated malware inevitably leave these markers behind, including prompt templates, API keys and jailbreak terms ^[23].

What is on the record is static analysis of a distribution build carrying placeholder API keys and a dummy webhook ^[10]. Talos says it did not observe a complete end-to-end execution of the architecture, and has no confirmation of in-the-wild deployment ^[10][2]. The only date attached to the actor is 2025, when binary artifacts link the developer to carding-related postings on criminal forums ^[3]. There is nothing here to patch this week, though the design is already compiled into a 16.4MB Go executable by someone posting on carding forums, and Talos says CLOSEDQUORUM is the first of a series of findings from its CAIRN toolkit ^[4][3][18].