---
title: ClosedQuorum - an autonomous AI Windows implant
url: https://www.broadcom.com/support/security-center/protection-bulletin/closedquorum-an-autonomous-ai-windows-implant
description: ClosedQuorum - an autonomous AI Windows implant
---

# ClosedQuorum - an autonomous AI Windows implant

September 24, 2026

Cisco Talos reported on a novel Windows implant dubbed ClosedQuorum that leverages an autonomous decision loop determining its post-compromise actions. By bypassing conventional attacker-controlled infrastructure or live operator prompts, the implant queries a panel of prominent commercial large language models (LLMs): DeepSeek, Qwen, Mistral, and Google Gemini. After sequentially surveying their responses, the binary tallies an algorithmic consensus to execute its subsequent actions. The current implementation of the malware is believed to be likely a proof-of-concept created by attackers exploring new possibilities opened up by AI.

Symantec protects you from this threat, identified by the following:

**Behavior-based**
- SONAR.TCP!gen1

**Carbon Black-based**
- Associated malicious indicators are blocked and detected by existing policies within Carbon Black products. The recommended policy at a minimum is to block all types of malware from executing (Known, Suspect, and PUP) as well as delay execution for cloud scan to get maximum benefit from Carbon Black Cloud reputation service.

**File-based**
- Trojan Horse
- Trojan.Gen.MBT
- Trojan.Malgent!ATN
- WS.Malware.1

**Machine Learning-based**
- Heur.AdvML.C