Four commercial LLM APIs vote on what the malware does next

No human operator. No C2 server. Four model providers as the command channel.

Cisco Talos disclosed CLOSEDQUORUM, which it calls the first reported fully autonomous AI command-and-control implant. The Windows implant collects host data, sends it to up to four commercial model providers (DeepSeek, Qwen, Mistral and Gemini), and executes whichever action wins the vote. Its goal is credential and crypto wallet theft. Talos has not confirmed any in-the-wild deployment, and The Register and BleepingComputer both carried the disclosure.

The voting design is the part that should bother you. It's not there for intelligence. It's there so no single provider's abuse detection sees a complete picture of what the implant is doing, and so blocking one API doesn't kill the implant. Every provider sees a fragment of a conversation that looks like a sysadmin asking about a host.

Detection is straightforward and nobody does it: outbound HTTPS to api.deepseek.com, generativelanguage.googleapis.com, api.mistral.ai and dashscope from endpoints that have no business talking to model providers. Your accounting workstation doesn't call Qwen. Your build server might, and that's the ambiguity attackers will live in as agent tooling spreads across the fleet. Write the rule now while the allowlist is still short.

The same week Microsoft, Health-ISAC, Cloudflare, Coinbase, OpenAI and Railway took down EvilTokens, a device-code phishing service that compromised over 12,000 inboxes at more than 10,000 organizations. It sold on Telegram for $1,500 up front plus $500 a month and used AI to find invoices, wire-transfer threads, and employees who could move money. 50 sites seized, 150+ domains disabled, two arrests by the Metropolitan Police on September 11. If your tenant still allows device-code authentication flow, restrict it today.

Two different shapes of the same shift. The model isn't the payload. It's the part of the attack that used to require a person.