DEV Community: Neural CoreTech

CLOSEDQUORUM: When Large Language Models Become Part of the C2 Loop

Neural CoreTech — Thu, 24 Sep 2026 08:52:37 +0000

The cybersecurity industry has spent the last two years discussing AI-assisted attackers, AI-generated malware and the potential for autonomous agents to change offensive operations.

CLOSEDQUORUM is interesting because it moves that discussion from theory into malware architecture.

Cisco Talos recently analyzed a Windows implant that uses multiple commercial LLM providers to influence its next tactical action. The public sample is not confirmed as part of an active campaign, but its design provides a useful look at how an LLM-driven malware control loop could work.

The architecture

At the center of the sample is a component Talos identifies as the ModelOrchestrator.

Rather than receiving every instruction from a conventional C2 server, the implant queries several models.

The reported providers are:

DeepSeek
Qwen
Mistral
Gemini

The models are prompted to behave as malware strategists, but their responses are constrained to a structured decision format.

This is an important implementation detail.

The models are not simply generating arbitrary shell commands that the malware executes directly.

Instead, the implant defines a limited set of possible capabilities. The model selects among those options, and the corresponding handler executes the action.

That creates a much more constrained and auditable decision architecture.

Voting instead of trusting one model

The malware does not appear to rely on a single model.

The providers are queried one by one and their decisions are combined through plurality voting.

A tie is resolved through a fixed provider order.

This is an interesting engineering choice.

From an attacker perspective, depending on one API introduces obvious reliability problems. The provider may be unavailable, rate-limit the request or refuse the prompt.

A multi-model design provides another layer of resilience.

The failure mode is also relatively conservative: when the models fail to provide a usable decision, the implant falls back to a non-operative state.

Why conventional C2 detection becomes harder

Traditional C2 detection often looks for infrastructure controlled by an adversary.

A suspicious domain.

A suspicious IP.

A custom protocol.

A recognizable beacon.

CLOSEDQUORUM changes that equation.

The implant can potentially communicate with infrastructure operated by legitimate commercial AI companies.

That does not make the traffic inherently suspicious.

Millions of legitimate systems can call AI APIs.

The defensive opportunity therefore lies in correlation.

Consider an executable that:

contacts several AI providers;
communicates with a Discord webhook;
accesses LSASS;
performs process injection; and
repeatedly reappears at irregular intervals.

Each signal has legitimate explanations.

Their combination is much harder to explain as routine application behavior.

The CAIRN response

Talos released CAIRN alongside the CLOSEDQUORUM research.

CAIRN is designed to identify AI-integrated malware through what Talos calls “cognitive artifacts.”

These can include:

prompt templates
model-provider endpoints
API-key prefixes
jailbreak-related terminology
tool-calling structures

The interesting part is that CAIRN starts from metadata rather than immediately executing suspicious binaries.

That makes the approach potentially useful for large-scale hunting.

There is a trade-off, however.

AI-related strings are not automatically malicious.

Legitimate applications can contain model names and API endpoints. Packaged binaries can also introduce substantial noise.

Metadata can narrow the search.

Reverse engineering still provides the final validation.

The biggest caveat

One detail should remain front and center when discussing CLOSEDQUORUM.

Talos did not observe a complete end-to-end execution of the public build.

The sample contains placeholder API credentials and a dummy webhook.

There is therefore no confirmed evidence that this exact sample represents an operational campaign in the wild.

That means the significance of CLOSEDQUORUM is currently architectural rather than epidemiological.

We are not looking at evidence that autonomous LLM-driven malware has suddenly become widespread.

We are looking at a concrete implementation showing how such a model-driven control mechanism could be built.

Why this matters for defenders

The traditional distinction between malware and AI software is becoming less useful.

A malicious executable can already use cloud APIs, encrypted channels, commercial infrastructure and third-party services.

The addition of an LLM creates another abstraction layer.

The endpoint may no longer receive an explicit command such as “execute capability X.”

Instead, the endpoint may receive context, ask one or more models for a decision, vote on the result and then execute a locally implemented capability.

From a detection perspective, that means the question becomes:

Which process is asking the model to make tactical decisions, and what does that process do immediately before and after the request?

That is potentially much more valuable than simply blocking AI domains.

CLOSEDQUORUM is still an early example, but it illustrates why AI security is increasingly becoming an endpoint-security problem as much as a model-security problem.

Plugin4Shell: The AI Coding Agent Supply-Chain Bug Hiding Beneath SHA Pinning

Neural CoreTech — Sun, 20 Sep 2026 16:52:01 +0000

What if an AI coding agent verifies the request for a specific commit, but never verifies the code it actually checked out?

That is the core issue behind Plugin4Shell.

AIR Security disclosed a zero-click RCE affecting Claude Code, OpenAI Codex, GitHub Copilot and Gemini CLI.

The interesting part isn't a clever prompt. It's Git.

An attacker-controlled repository can exploit reference resolution so that a supposedly pinned plugin resolves to malicious code instead.

In the article, I break down both attack variants, the different implementation paths across the four agents, current patch status, and a practical hardening checklist for engineering teams.

The bigger lesson: AI agent security increasingly extends into the software supply chain.

Read the full technical breakdown:
https://neuralcoretech.com/plugin4shell-ai-coding-agents-security/

What if the biggest problem with AI coding agents isn't that they don't have enough tools—but that they have too many?

Neural CoreTech — Sun, 30 Aug 2026 13:13:17 +0000

An agent with access to GitHub, CI/CD, databases, documentation, issue trackers and deployment infrastructure sounds powerful.

But every additional capability introduces another question:

Should the agent use it?

And then:

Does it have the right context?
Does it have permission?
Is this the right workflow?
How do we verify the result?

This is where MCP plugins move beyond simple tool integration.

The interesting architectural question isn't:

“How many tools can my AI agent access?”

It's:

“How intelligently can my agent compose the capabilities it needs to achieve a specific goal?”

In the article, I examine an architecture built around:

Intent → Workflow → Capabilities → Context → Action → Verification

and explore why MCP may increasingly become the infrastructure layer underneath reliable AI developer workflows.

If you're building or evaluating AI coding agents, MCP integrations, or agentic developer systems, this is the part of the MCP conversation worth watching.

👉 Read the full article:https://neuralcoretech.com/mcp-plugins-developer-workflows/

Question: Which action would you allow an AI coding agent to perform autonomously—and which would always require human approval?

MCP vs A2A in 2026: Why Agentic AI Needs Both

Neural CoreTech — Mon, 24 Aug 2026 10:43:46 +0000

Agentic AI is evolving from isolated assistants into distributed systems where multiple agents can access tools, delegate tasks and operate across different platforms.

That creates an interoperability problem.

Two protocols are increasingly important:

MCP (Model Context Protocol)
→ connects agents to tools, resources, files, databases and APIs.

A2A (Agent2Agent)
→ connects independent agents so they can discover capabilities, communicate and delegate tasks.

The distinction is simple, but the architectural consequences are significant.

MCP is the tool layer

Imagine an agent that needs to:

query a PostgreSQL database
search internal documents
access GitHub
create a support ticket
call a SaaS API

Instead of writing a custom integration between the agent and every service, MCP provides a standardized protocol layer.

A2A is the agent coordination layer

Now imagine that your primary agent receives a task requiring specialized expertise.

Instead of implementing all that expertise internally, it can discover another agent and delegate the task.

That second agent might be built with another framework, another model or even by another organization.

That's where A2A becomes interesting.

Why the AAIF development matters

Google's A2A protocol has now moved into the Linux Foundation's Agentic AI Foundation, alongside MCP.

This is significant because interoperability standards are much more useful when competing vendors have reasons to adopt them.

The industry doesn't need one giant "everything protocol."

It needs clearly defined interfaces that work together.

A useful architecture is therefore:

LLM / Reasoning

↓

MCP

↓

Tools + Data + APIs

and alongside that:

A2A

↓

Other Agents

This creates a modular agent stack instead of a collection of proprietary integrations.

Our full analysis goes deeper into:

→ MCP vs A2A architecture
→ AAIF governance
→ framework support
→ Microsoft Agent Framework, CrewAI, Pydantic AI, Google ADK, LangGraph and others
→ practical implementation steps
→ agent security and interoperability
→ what developers should watch through the rest of 2026

Full article in NeuralCoreTech(.)com

AI #AgenticAI #MCP #A2A #LLM #AIEngineering #Developers #OpenSource

The AI coding assistant market has evolved into something much bigger than autocomplete.

Neural CoreTech — Fri, 31 Jul 2026 07:41:03 +0000

Today's leading tools can plan changes across an entire repository, execute terminal commands, verify test suites, interact with external systems, and even coordinate multiple autonomous agents.

That shift changes how developers evaluate these platforms.

Instead of asking which model tops a benchmark, we increasingly need to ask which architecture best fits a specific development workflow.

I put together a detailed comparison covering six of today's leading AI coding agents, including Claude Code, OpenAI Codex GPT-5.6, Cursor Composer 2.5, Devin Desktop, GitHub Copilot, and open-weight alternatives such as DeepSeek V4 and Kimi K3.

The guide covers architecture, pricing, context windows, production use cases, setup instructions, and practical recommendations based on real development scenarios.

Hopefully it serves as a useful reference for anyone building AI-assisted software in 2026.

https://neuralcoretech.com/best-ai-coding-agents-2026/

Choosing the "best" AI coding model has become increasingly difficult.

Neural CoreTech — Thu, 30 Jul 2026 07:33:40 +0000

And maybe that's because it's the wrong problem.

In this article, we explore how engineering teams are beginning to treat AI models like specialized teammates instead of universal assistants.

Rather than selecting a single model, they assign different models to planning, implementation, terminal automation, and independent code review.

The article includes:

• Latest benchmark comparisons
• Claude Opus 5 vs GPT-5.6 Sol
• Grok 4.5 analysis
• Kimi K3 open-weight deployment realities
• Git worktree architecture
• Cross-vendor orchestration workflows
• Practical implementation guidance

Whether you're building enterprise software or experimenting with AI-assisted development, I hope you'll find something useful.

Full article:
https://neuralcoretech.com/ai-coding-agents-2026-cross-vendor-multi-model-orchestration/

Looking forward to your feedback and experiences.

AIAgents #SoftwareDevelopment #LLMs #CodingAgents #MachineLearning

Most articles comparing AI meeting assistants stop at feature checklists.

Neural CoreTech — Mon, 27 Jul 2026 10:08:35 +0000

I wanted to go one step further.

This guide explores the technical architecture behind today's leading AI meeting platforms—including how they capture audio, perform speaker diarization, structure summaries with LLMs, and integrate meeting knowledge into broader productivity systems.

The comparison includes:

• Granola
• Notion AI Meeting Notes
• ClickUp Brain²
• Motion
• Fireflies.ai
• Otter.ai
• Fathom
• Krisp

Beyond pricing and features, I also explain why capture architecture (bot-free vs bot-based) has become a key technical consideration for enterprise deployments, especially where compliance and meeting policies matter.

If you're building AI-powered workflows or selecting productivity software for your organization, I'd love to hear your perspective after reading the article.

Benchmarks don't tell you how painful migration will be.

Neural CoreTech — Fri, 24 Jul 2026 09:12:19 +0000

Architecture does.

I published a technical deep dive comparing today's leading AI coding assistants, including DeepSeek V4, Kimi K3, GitHub Copilot, Cursor, Windsurf, and Claude Code.

The article covers:

• API-compatible model switching
• IDE sidecar architectures
• Autonomous coding agents
• Self-hosted open-weight deployments
• Common migration pitfalls
• Enterprise deployment strategies

Read the full article and let me know which AI coding assistant you believe has the strongest long-term strategy.

ArtificialIntelligence #AI #GenerativeAI #LLM #SoftwareEngineering #DeveloperTools #GitHubCopilot #ClaudeCode #Cursor #DeepSeek #OpenSourceAI #EnterpriseAI #MCP #AIInfrastructure

If you're building developer platforms, AI tooling, or production agentic systems, this guide should save you time—and potentially a costly migration mistake.

What if the future of AI coding is decided by the cost of completing a task—not by benchmark scores?

Neural CoreTech — Thu, 23 Jul 2026 10:58:18 +0000

That is exactly where the market may be heading.

Gemini 3.6 Flash is targeting cheaper agentic coding workloads, while Kimi K3 is preparing to bring a massive 2.8T-parameter open-weight model to the developer ecosystem.

I compare these models with Claude Code, GitHub Copilot, Cursor and Windsurf—and explain which approach makes the most sense for different developers and organizations.

NeuralCoreTech(dot)com

MCP, Local LLMs, and the New Architecture of Secure Agentic AI

Neural CoreTech — Wed, 22 Jul 2026 16:22:55 +0000

AI agents are moving from chat interfaces into real execution environments.

They can now call APIs, access databases, manipulate files, and orchestrate workflows.

But this creates a fundamental engineering problem:

How do we give autonomous systems enough capability without giving them uncontrolled access?

The answer is not simply a better LLM.

It requires a new architecture.

In this deep dive, I explore:

Model Context Protocol (MCP) architecture
Agent runtime security boundaries
Host–Client–Server communication model
Local LLM deployment patterns
Zero-Trust approaches for AI agents

Key takeaway:

The future of AI engineering is not only about model intelligence. It is about secure orchestration.

Read the complete technical breakdown

machinelearning #ai #llm #security #opensource

AI security is becoming an architecture problem.

Neural CoreTech — Tue, 21 Jul 2026 10:14:22 +0000

The next generation of cybersecurity tools will not simply ask, “Which LLM is the smartest?”

They will ask:

Which model should handle this task?
When should a frontier model be used?
How can vulnerability discovery scale economically?
How much autonomy should an AI security agent have?
Where must human approval remain mandatory?

Microsoft’s reportedly unconfirmed Project Perception is interesting precisely because it appears to embrace a multi-model orchestration architecture, routing routine tasks to cheaper models and complex exploit reasoning to frontier models.

Anthropic’s Project Glasswing and Claude Mythos 5 represent a contrasting philosophy: highly capable, restricted-access AI focused on autonomous vulnerability discovery.

In my latest deep dive, I compare these approaches with the AI security tools enterprises can evaluate today, including Claude Security, Microsoft Security Copilot, Agent 365, CrowdStrike Charlotte AI and SentinelOne Purple AI.

The key takeaway: AI vulnerability discovery and AI agent identity governance are complementary problems. Solving one does not solve the other.

👉 Read the full analysis: https://neuralcoretech.com/ai-security-two-horse-race-microsoft-anthropic/

ai #cybersecurity #security #llm #devsecops #cloud #agents

Everyone is talking about building smarter AI agents.

Neural CoreTech — Sun, 12 Jul 2026 14:16:52 +0000

Building AI agents is becoming easier.

Securing them is becoming much harder.

Most prompt injection discussions focus on user input, but production systems process much more than that. They consume retrieved documents, API responses, search results, tool outputs, emails, knowledge bases, and countless other external sources.

Every one of those can become an attack vector.

In this technical guide, I walk through a production-oriented Runtime Prompt Defense architecture using Lakera Guard as middleware before the LLM.

Topics include:

• Direct and indirect prompt injection
• Runtime validation for tool responses
• Output filtering
• Next.js Edge Runtime implementation
• Langfuse observability
• OWASP ASI 2026 mapping
• Multi-layer enterprise security architecture
• Comparison with other runtime defense platforms

The goal wasn't simply to explain prompt injection, but to show how security teams and AI engineers can build practical runtime defenses without introducing unacceptable latency or operational complexity.

I'd love feedback from developers already deploying AI agents in production. How are you validating external content today?