Skip to content
ROAI

September 23, 2026 · Issue 38 · 4 min read

Malware now asks four commercial models what to do next, and the evidence is in your egress logs

The daily briefing film for this issue, 4:10.

Cisco Talos published an analysis on September 22 of CLOSEDQUORUM, a Windows implant it calls the first reported autonomous AI command and control implant, per the Talos write-up(opens in a new tab). After deployment it collects host context, sends it to DeepSeek, Qwen, Mistral and Gemini, and runs whichever prewritten action wins a plurality vote. The targets are ordinary: domain credentials, browser passwords, cryptocurrency wallets. Talos has not confirmed use in the wild, and the public build ships with placeholder API keys. That caveat matters, and it is also beside the point for a budget owner.

The point is where the decision now happens. The operator's judgment used to arrive over a command channel a security team knew how to hunt. Here it arrives as an ordinary HTTPS call to a commercial model API, the same kind of traffic your own pilots generate every day. Talos's detection advice is correlation, not a signature: model API traffic from executables that have no reason to make it, combined with credential access and process injection. Most enterprises cannot do that today, because nobody keeps an inventory of which processes are allowed to call which model providers.

The same gap showed up from the other direction this week. Security researcher Patrick Wardle showed that a local app or terminal command could change an undocumented setting in Meta's Muse agent, redirect its transcription traffic, and capture its authentication tokens, per Malwarebytes(opens in a new tab). Meta hot-fixed it roughly 16 hours after disclosure, per Unite.AI(opens in a new tab). The patch is not the story. Malwarebytes makes the sharper point: a compromised agent hands an infostealer email, calendar, files and payment methods behind one already authenticated interface. If an employee has connected that agent to corporate mail, the blast radius is yours, and many security teams would have no record that the connection exists.

The cost argument is simple. Neither incident required a new security product. Both require an inventory: which agents hold corporate credentials, and which binaries talk to model APIs. That is an egress allowlist and a credential review, work most security teams already know how to do and have not yet pointed at AI traffic. The cheapest control this quarter is to start logging it, so that when a real CLOSEDQUORUM variant runs, the evidence exists.

Action items

An implant that outsources its decisions to commercial models, a consumer agent whose stolen tokens open everything it was connected to, and a benchmark that puts the authorization check outside the model.

For the CISO. Build the inventory Talos's detection advice assumes you have. List every process and service that is supposed to call a model provider, then alert on model API traffic from anything else. Pair it with the signals Talos names: credential store access and process injection from the same host.

For the CIO. Find out how many employees have connected a consumer agent such as Muse to corporate mail or calendars. If the only way to answer is a survey, that is the finding. Decide whether those agents are blocked, tolerated, or brought under a managed contract, and write the decision down.

For procurement. Ask any agent vendor for three things in writing: an admin view of what the agent accessed across the organization, an audit export your SIEM can ingest, and a list of every credential type the agent accepts that does not show up as an OAuth grant.

For the CFO. None of this needs new budget yet. It needs existing egress and identity controls pointed at AI traffic, which is cheaper now than after the first incident review asks why the logs were empty.

Researched and drafted by an automated workflow, then reviewed and edited by a human editor before publication. Every source is linked. See how we use AI here.

Also worth knowing