On a workbench inside Cisco Talos, a binary sat in metadata long before anyone detonated it. The sample would later be called CLOSEDQUORUM. Researchers on the CAIRN project were hunting files that pick a next move without a human on the other end of the channel. If your cybersecurity program still treats command and control as a tired operator behind a dashboard, this implant is the brief that the operator is now optional.

The file kept the meeting going by itself

CLOSEDQUORUM is the first reported implant with fully autonomous command and control, according to Talos. That phrase is doing real work. Classic malware still calls home, waits, then follows a tasking queue. This family keeps going when nobody is staffing the queue. Talos describes a shift in effort displacement: attackers push more of the chain into the sample so a human can stop babysitting beacons.

You have spent years tuning alerts for that babysitting. Beacon jitter. Off-hours logins. A domain that lights up after a click. An implant that chooses its own next action will not give you those human tells. The timing looks like software because it is software. Your on-call runbook that says “watch for the callback” is already late.

CAIRN, the open-source framework Talos used to find and classify this class of files, never needs you to download or run the malware. It works from metadata: submitter, import hash, domain, AI provider. That is a practical tell for shops that already drown in detonations. The interesting graph is who submitted the file, which model endpoint it talks to, and which other binaries share the same import hash. You can steal that idea without running their explorer. Start clustering the AI-shaped artifacts in your own telemetry before the first sandbox movie.

The same relentlessness already has a badge

While Talos was naming an unsupervised implant, identity researchers put the same pattern on a badge you already issued. AI agents are rewriting lateral movement. Teams have spent decades asking whether an identity has too much access. Agents raise a harder question. Given the access already granted, which paths can an autonomous system discover?

A person tries a few doors and gets tired. A line-of-business app follows the flow a developer wrote. An agent keeps going until the task is marked done. That relentlessness is the design choice CLOSEDQUORUM encodes in malware. Inside your tenant it wears a service principal, a bot identity, or a coding assistant with a token. On a compromised host it wears a model call.

Bruce Schneier’s note this week on GPT-6 Astra is a capability snapshot. Carter Leffer pointed the model at unbroken Enigma messages on a research site. The model picked message Nr. 172, suspected a related ciphertext, wrote Python and C++ for a simulator and a Bombe, and used the repeated place name ROSENOW as a crib until the key fell out. Nobody sat there clicking through rotor settings. If a model can assemble its own cryptanalytic lab for a museum puzzle, you should assume an implant can assemble its own next hop.

Your firewall still matters. It does not vote. Egress to an AI provider, a token service, or a tool-runner looks like productivity traffic. A threat-protection stack that only scores known bad IPs will grade this as a quiet, successful day.

Cybersecurity still expected a handler on nights

The real problem here is staffing and assumption. Your playbooks, your on-call, and a lot of your threat detection still expect a person in the loop on the attacker side. CLOSEDQUORUM is the sample that makes that expectation expensive.

Do the immediate work today. Inventory every non-human identity that can call tools, spawn jobs, or reach a model endpoint. Treat those identities as C2-capable even when they were issued for helpdesk summarization or code review. Cut standing privileges. Shorten token life. Require step-up for any identity that can enumerate directories, clone repos, or read mailboxes. If you cannot list the agents in a tenant, you cannot do incident response when one of them walks a graph.

On the host and network side, stop waiting for a noisy brute-force spray to announce a problem. Autonomous samples can skip the spray and spend their budget on a useful next action. Log outbound calls to AI providers with the same seriousness you log VPN concentrators. Pair process telemetry with identity telemetry so a model-driven implant shows up as a loop: a tool, a result, another tool, another host.

Run a tabletop this week where the beacon never arrives. The implant already has a local policy for what done means. Your incident response lead isolates on behavior, not on a takedown blog post. Pull the host. Revoke the tokens. Kill the service principal. Then ask which other non-human identities could have discovered the same path.

Fold this into security hardening and defense in depth the same way you folded living-off-the-land into Windows. Least privilege for agents is a path budget. Give an agent a small graph and it will finish the small graph. Give it the tenant and it will finish the tenant. Review tool allowlists on a fixed cadence. Alert on fan-out: one identity touching many mailboxes, many secrets, many servers in a short window. Keep a clean picture of which cyber security controls sit at identity, which sit at egress, and which sit on the box, because a closed quorum only needs one of those layers to be asleep.

Vendors will ship an autonomous-threat dashboard next quarter. You already have the controls. You have been using them against humans. Point them at the vote.

Sources

• The Closed Quorum: Inside the first reported autonomous AI C2 implant
• Researchers uncover malware that uses AI to choose its next move
• AI Agents Are Rewriting the Rules of Lateral Movement
• GPT-6 Astra Breaks an Old Enigma Message