Two of today’s stories are the same story wearing different clothes. On Tuesday Cisco Talos documented a Windows implant that asks four commercial AI models what to do next, and on Wednesday the two CEOs whose models were absent from that list stood in front of the UN Security Council asking for international rules.<\/p>\n\n\n\n
Cisco’s Talos group published its teardown<\/a> of an implant it calls CLOSEDQUORUM, which it describes as the first reported autonomous AI command and control implant. The mechanism is the part you need to understand. Once the implant lands on a host, it stops waiting for a human operator and instead polls up to four commercial models, DeepSeek, Qwen, Mistral and Google Gemini, asking each to pick the next post-compromise action from a prewritten list. Each active model votes, and the action with the most votes wins. Ties break in a fixed order, with DeepSeek first and Gemini last.<\/p>\n\n\n\n The rest of the specification is ordinary criminal work. Talos describes a 16.4MB 64-bit Windows executable compiled in Go that dumps LSASS, lifts saved credentials out of Chrome, Edge and Firefox, and goes after MetaMask, Exodus and Ethereum wallets. Development builds inject provider API keys at compile time. The publicly circulated sample ships with a placeholder key, so what Talos analysed is the plumbing rather than a live operation.<\/p>\n\n\n\n Here is the detail nobody else pulled out, and I checked it against the Talos writeup directly rather than the coverage: no OpenAI model and no Anthropic model appears in that quorum. Resist the flattering explanation. One sample is not a safety league table, and the likelier reading is mundane, because the four chosen providers are the ones with the cheapest keys and the least friction for an attacker who needs volume and does not want a billing relationship that leads anywhere. Talos also shipped a defensive toolkit alongside the research, an open-source project called CAIRN for hunting AI-integrated malware, which is the more useful half of the announcement if you run detection. If you have been tracking how fast this category moves, this sits directly downstream of the zero-click bug that hit four coding agents<\/a> last weekend.<\/p>\n\n\n\n Triage: breaks your stack.<\/strong> Your egress filtering probably treats api.deepseek.com and generativelanguage.googleapis.com as ordinary SaaS. They are now a command channel.<\/p>\n\n\n\n France used its rotating presidency to put AI in front of the Security Council on Wednesday. Altman appeared in New York and Amodei joined by video link, and both argued the industry cannot set its own terms alone. Amodei told the council that if managed poorly he believed AI could be a risk to humanity as a whole, and put three mechanisms on the table: narrow global agreements such as a ban on using AI to build biological weapons, verification systems so states can check each other’s commitments, and shared testing standards with a notification channel for AI security incidents. Altman’s framing was blunter, telling the council that if AI is to be democratic then the most important decisions cannot be made by labs in San Francisco alone. Yoshua Bengio, who co-chairs the UN’s independent scientific panel, told the room the dangers are real and imminent.<\/p>\n\n\n\n Then the United States killed it in one sentence. Michael Kratsios, speaking for the administration, said Washington totally rejects all efforts by international bodies to assert centralised control and global governance of AI, as Al Jazeera’s account of the session<\/a> records. That is the whole story. Nothing binding is coming out of a Security Council where a permanent member has pre-rejected the premise, and the labs know it, which is why the same week produced a proposal for a voluntary industry standards body modelled on FINRA instead.<\/p>\n\n\n\nAltman and Amodei Asked the Security Council for Rules<\/h2>\n\n\n\n