Cisco Talos finds CLOSEDQUORUM, first 'LLM-as-C2' malware that automates the attack chain
ChuckDBrooks · x · 2026-09-24
- Cisco Talos researchers identified what they call the first "LLM-as-C2" architecture: malware dubbed CLOSEDQUORUM queries multiple LLM judges, tallies their decisions, and automatically executes the winning action — fully automating the command-and-control chain for credential theft.
- Researcher Ryan Fetterman: this doesn't just augment an operator, it "transfers an entire phase of the attack from the operator to the system."
- Key implication: the human-in-the-loop bottleneck is gone — no working hours, attention limits, or sleep. "It does not go offline when the attacker sleeps."
Related event: First LLM-as-C2 Malware CLOSEDQUORUM Discovered(2 posts)→
More from Safety
- AI safety researcher hires paid, credited RA/co-writer to speed up memos and blog posts — davidmanheim · 2026-11-11
- How long should an approval for an agent action stay valid? — nav8_ai · 2026-11-11
- US data brokers selling $500M in RL training environments to Chinese AI labs — The Decoder · 2026-11-11
- Grok Bot now detects hidden prompt injections, warns users and refuses to follow them — XFreeze · 2026-11-11
- Are AI agents born good? Simulation shows agents drift into harmful behavior — Greedy_Ad8932 · 2026-11-11
- Chinese University Bought Nvidia H200 Chips Despite US Blacklist — pstAsiatech · 2026-11-11