The vote was an argmax - CLOSEDQUORUM polls four model providers, and the AI Act hands the Union an addressee rather than an off switch

Cisco Talos published CLOSEDQUORUM on 22 September 2026: a 16.4 MB Go Windows implant that queries DeepSeek, Qwen, Mistral and Google Gemini in sequence and acts on the plurality of their verdicts, re-executing at randomised five-to-fifteen-minute intervals and exfiltrating AES-256-GCM encrypted data over a Discord webhook. The quorum is not one: the tally uses a strict less-than comparison, so the first-encountered maximum wins and DeepSeek, first in the preference order, carries every tie - an argmax artefact rather than a designed consensus rule. The practitioner consequence is not the malware but the detection signal it creates, because Talos's own guidance is that the most useful strategy remains behavioural characteristics rather than domain blocking, and one named signal is similar requests sent to several model providers within a short interval - which describes an ordinary multi-provider routing layer as well as it describes the implant. The instinct to look to the AI Act for a provider-side off switch does not survive the text: Article 54 obliges third-country GPAI providers to appoint an authorised representative in the Union whose tasks are verifying documentation, holding it ten years, answering reasoned requests and cooperating with the AI Office, and contains no duty to police or terminate customer misuse; the nearest thing, serious-incident reporting under Article 55(1)(c), binds only providers of models designated as having systemic risk, a designation Article 52(6) requires the Commission to publish as a maintained list. Nothing there revokes an API key, and in the operational builds that key is compiled in at build time. The move is attribution: one credential per agent per environment, never compiled into an artefact, provider and model and purpose logged on every call, and an alert when an agent reaches a provider it has no business reaching.

Post

A Windows binary woke up every few minutes, asked four different AI companies what to do next, and did what the majority said. Nobody was at the keyboard.

Cisco Talos published CLOSEDQUORUM on Tuesday — to their knowledge the first publicly documented Windows implant to put tactical command and control in the hands of a model vote.

Flat:

It queries DeepSeek, Qwen, Mistral and Google Gemini in sequence, tallies the verdicts and acts on the plurality. A conventional implant phones one hard-coded server. This one polls four commercial APIs per decision, on a randomised 5–15 minute cycle, and exfiltrates over a Discord webhook.
The quorum is not a quorum. The tally uses a strict less-than comparison, so the first maximum encountered wins. DeepSeek is first in the list and therefore carries every tie. Nobody designed that. It fell out of an argmax.
Before you file it under malware and move on — Talos's own advice is that "the most useful detection strategy is still to focus on behavioral characteristics, rather than domain blocking", and one of the named signals is "similar requests potentially sent to several model providers within a short interval". That is multi-provider fan-out. That is a routing layer half of us ship.
And if your instinct is that the providers should just cut the account off: the AI Act gives the Union an addressee, not an off switch. Article 54 requires non-EU GPAI providers to appoint an authorised representative, whose tasks are verifying documentation, keeping it for ten years, and cooperating with the AI Office. Serious-incident reporting under Article 55(1)(c) binds providers of models designated with systemic risk — and Article 52(6) makes the Commission publish that list, so you can go and check which of these four are on it. Nothing there revokes an API key. The key was bought, and in the operational builds it is compiled in at build time.

My Monday: one credential per agent, per environment, never compiled into an artefact. Log provider, model and purpose on every call. Alert on an agent reaching a provider it has no business reaching — and write down your own fan-out before someone else's YARA rule does.

The control surface here is a paid account, and no regulator is scheduled to revoke it.

Which of your agents could you name the credential for right now?

#AgenticAI #EUAIAct #AppSec #AIGovernance #DevSecOps

AI disclosure: the narration voice, the cover art and the brand ident animation in this video are AI-generated. The script, the claims and the source checks are mine.

First comment

Sources, primary first.

Cisco Talos, Ryan Fetterman, 22 September 2026 — the full analysis: the vote, the tie-break, the 16.4 MB Go binary, and the detection guidance I quote: https://blog.talosintelligence.com/the-closed-quorum-inside-the-first-reported-autonomous-ai-c2-implant/

The companion post introducing CAIRN, the metadata-first toolkit Talos open-sourced the same morning: https://blog.talosintelligence.com/introducing-cairn-frontier-tracking-for-ai-integrated-malware/

CAIRN itself — MIT, Python, 26 YARA rules across three tiers, and honest in its own README that T1 and T2 hits without genuine AI integration are common: https://github.com/Cisco-Talos/Cognitive-Artifact-Intelligence-Research-Network

AI Act Article 54 — what a non-EU GPAI provider's authorised representative actually has to do. Read the task list and notice what is not on it: https://artificialintelligenceact.eu/article/54/

Article 55 — the systemic-risk duties, including the serious-incident report to the AI Office in 55(1)(c): https://artificialintelligenceact.eu/article/55/

Article 52(6) — the Commission's duty to publish and keep current the list of models designated with systemic risk: https://artificialintelligenceact.eu/article/52/

One point I cut for length: Talos says plainly they have no confirmation of in-the-wild deployment, and the public build ships with placeholder API keys and a dummy webhook, so no end-to-end execution was observed. This is a capability demonstration, not an incident. I am writing about it because the detection signal it creates lands on architectures that are entirely legitimate — not because anyone got hit.

Claims

Sources

AI disclosure

The video for this edition contains AI-generated media: the narration is a synthetic voice, the cover art and any background imagery are generated, and the brand ident animation is generated. The script, the claims and the source verification are human-authored and human-checked. Assets carry IPTC DigitalSourceType and C2PA Content Credentials.