VOLTA Malware Asks an AI Model to Price Its Victims

Security researchers at Cisco Talos found a variant of the data-stealing malware VOLTA, called VOLTA-AUTODOXER. Once installed on a target machine, this program steals passwords, cookies, cryptocurrency wallets, and sessions. Then it contacts an AI model to assess the target. How much are the target's assets worth? How well protected is the target? By default it queries Claude Opus 4.6 through the OpenRouter service, which routes requests to various AI providers. If Claude refuses to answer, it tries Kimi K2 (from Moonshot AI) or Gemini 2.5 Flash (from Google). It asks the AI model to "play the role of a forensic intelligence analyst compiling a target assessment." Part of the response covers the target's estimated worth and how well defended it is.

This shows that, despite all the noise around Chinese models, Opus remains the best available model for formal reasoning tasks. But there is a bigger point here. Unrestricted access to your AI agents through third-party interfaces will eventually get abused. If there is no filter between the user and your agents, someone will find a way around it.