AI in 15 — November 01, 2026

New malware steals your passwords, then asks Claude how much you're worth. And if Claude says no, it just asks a different AI.

Welcome to AI in 15 for Sunday, November 1, 2026. I'm Kate, your host.

And I'm Marcus, your co-host. A Sunday edition, Kate, and the criminals clearly didn't take the weekend off.

They never do. Here's what's coming up. An infostealer that hands its victims to a language model for a valuation.

Claude users say reverse-engineering work is suddenly getting blocked, with no announcement from Anthropic.

A single shared ChatGPT link that could take over your account.

AI agents from a startup founded by former DOGE staffers say they got into Anthropic's business systems.

Plus OpenAI merges your chat and coding allowances, Google's Genie 4 learns to make sound, and GPT-5.6 launches a rocket in Factorio, mostly.

Marcus, Cisco Talos published this on Friday. What is VOLTA?

On the surface, a fairly ordinary Windows infostealer, first seen on October eleventh. It takes everything you'd expect: browser data, payment cards, crypto wallets, and it even has a built-in wallet cracker. Plus messaging and gaming sessions, SSH and cloud keys, saved Wi-Fi passwords. Talos calls it mature, so it's no hobby project. What's new is an optional AI layer that runs after the theft.

And what does that layer do?

It turns each victim into a case file. The malware builds what Talos calls an evidence bundle: where you are, who you work for, the last four digits of your card, even a live valuation of your Roblox account. Then it enriches that bundle using the sessions it has just stolen. It might search your Gmail for receipts to confirm your home address, or pull your food-delivery order history.

That's horrible. It's reading my takeaway orders.

It is. Then the whole bundle goes to a language model. The system prompt tells the model to act as a "forensic analyst" writing a target assessment. One required section is called "WHAT THEY'RE WORTH," which sorts your assets by how easy they are to cash out. Another is "THEIR OPSEC," which rates your password habits.

So it's a performance review, except the reviewer is a criminal.

Pretty much. And the model choice is the part I keep returning to. Requests go out through OpenRouter, which is a service that sends one API call to whichever model you pick. The default is Anthropic's Claude Opus 4.6. The malware checks the reply for refusal phrases. If Claude declines, it tries Moonshot's Kimi K2, and if that fails too, Google's Gemini 2.5 Flash. The temperature is set to zero point two, so the reports come out consistent.

Wait. So the authors assumed Claude would refuse some of the time, and planned for it.

That's the key point. Refusals are treated as something to route around. So any one lab's guardrails are only as strong as the weakest model reachable on the same router. You can build the most careful model in the world, and the attacker swaps it out with one config line.

Who actually uses this?

It's sold as a builder. Customers plug in their own Telegram channel and their own API keys, and they get a custom binary back. Talos found no infrastructure owned by the attackers at all. Every endpoint is a legitimate third-party service. There is one bit of good news. The embedded key encryption is weak, so the keys can be pulled out of the binary, which helps defenders and the providers shut those accounts down.

Why does this matter beyond the creepiness?

Talos calls it "effort displacement." It used to take a skilled human to go through thousands of stolen logs and work out which victims were worth the effort. Now a low-skill buyer gets that as a ranked list. The theft itself hasn't changed. Picking who to go after has become cheap.

The top Hacker News comment had a silver lining, though.

"Ha, finally me being poor pays off!" Although, given the Roblox valuations, I'd check on your kids' accounts.

Quick hits. Staying with Anthropic and security, but from the other direction. Since around October twenty-first, Claude users have been reporting that reverse-engineering work gets refused.

Yes, and the range is wide. Game decompilation, which is a huge hobbyist scene. People rebuild old N64 games from the machine code so they can be preserved and ported. Cloning old games. And, more worrying, rooting a smart TV or patching the firmware on hardware the user owns. Tom's Hardware, Kotaku and Mashable have all covered it.

Has Anthropic said anything?

Nothing specific. There's no new Opus 5.5 version, no patch notes, and no statement about games. But the way the refusals look is a clue. They often show up as mid-response cutoffs, with the answer stopping partway through. That points to a classifier sitting on top of the model, not the model itself deciding to say no. One report says Claude will still help you analyse code in Ghidra, the reverse-engineering tool, but blocks you when you try to generate or package the modified code.

So, probably the cyber-safety filters.

That's the most plausible explanation. And experiences vary. Some modders say nothing has changed for them. One secondary blog claims even Anthropic's Defense Access tier saw forty-six of fifty reverse-engineering trials blocked at some point, but I'd treat that number cautiously.

There was also a viral tweet about Anthropic banning people.

Two hundred and eighty-nine points on Hacker News. It claimed Anthropic blocks users for "anything touching training larger models." I couldn't find any coverage beyond the tweet itself. Commenters noticed the user appears to be in Hong Kong, where Claude is geo-blocked, so probably on a VPN. And Anthropic's terms have always barred using its outputs to train competing models. It has enforced that hard since February, when it accused Chinese labs of distillation at industrial scale. So I wouldn't read that one as a new policy.

But the reverse-engineering story is different.

It is, because reverse engineering is mostly legal and it's essential work. It's how security research, interoperability and software preservation get done. My real complaint is that none of this was announced. If a paying customer can't tell whether a refusal is a policy or a bug, they can't plan around it. The top Hacker News comment said "every professional user should be actively cultivating a set of alternatives and fallbacks." That's good advice for any tool you depend on.

And people expect open-weight models to fill the gap.

Within a year, most commenters reckon. Given Mistral's release this week, that seems about right.

Next, a bug report that reads like a heist movie. Researchers at Parameter Labs turned one public ChatGPT share link into a full account takeover.

It's a chain of small mistakes. The shared conversation rendered an ordinary graph using a maths library called MathLive. MathLive installed a listener on the main ChatGPT page that accepted messages from any website, with no check on who sent them. Further down the same share, an HTML Preview block sent messages that swapped in an attacker-supplied "keyboard layout."

A keyboard layout. Of all the things.

Of all the things. That layout's HTML went in without sanitising, and an unsandboxed iframe then ran the attacker's JavaScript as if it came from chatgpt dot com itself. ChatGPT has a Content Security Policy, a list of approved script sources, so the payload loaded its code through a YouTube embedding endpoint that was already on that list.

And what did the victim have to do?

In the most reliable version, click Preview once. Later the block was set to auto-preview, so just opening the link was enough. The proof of concept listed the victim's chats, read a private conversation, and sent the data to an outside server.

Did OpenAI fix it quickly?

Fairly quickly. It was reported on October eighteenth, raised from P2 to P1 three days later, and resolved by the twenty-sixth after fixes to two frontends. The bounty was five thousand dollars, and Hacker News didn't think much of that. Five thousand for a P1 account takeover on a service holding people's most private conversations seems low, and low bounties push researchers toward other buyers.

What's the wider lesson?

Chatbots are full web apps now. They render graphs, maths widgets and HTML previews, often from untrusted content. So the classic web bugs are back, and the target is an account where people tell a chatbot things they wouldn't tell their doctor.

Another one still doing the rounds this weekend. The Washington Post reported that Cathedral, a security startup founded by former DOGE staffers, had its AI agents break into Anthropic's internal systems.

Cathedral says its autonomous agents found routes into Anthropic's sales, HR and IT systems in under twelve hours. According to the draft report the Post saw, they reached meeting transcripts, salary details, job offers, and Slack messages about advanced models. The important detail is how they got in: third-party business software, not Anthropic's own products. Cathedral reportedly spent several days trying to break Anthropic's own software first and failed.

And Anthropic's side?

It says its monitoring flagged part of the activity before Cathedral reported it, and it cut off access the same day. It says no Claude conversations, model weights or source code were touched. And the twelve-hour figure comes only from Cathedral. Nobody has verified it independently.

I have to ask, Marcus. Is this a breach, or a pentest nobody asked for, with a press release attached?

Honestly, a bit of both. A months-old startup getting a Washington Post story the same week as Anthropic's IPO filing is excellent marketing. But the lesson holds regardless of the motive. Even a security-focused lab is exposed through its software vendors, and agents make sweeping all those vendors cheap. Most companies have dozens of those tools, and each one is a way in.

A consumer one now. OpenAI is emailing users that "Chat and Work are coming together." Marcus, you read the small print.

Buried in the email is "a shared allowance for ChatGPT and Codex." The help page blocked automated fetching, so the details come from people quoting the email on Hacker News. But the practical worry is simple. Spend your quota on a long agentic coding session, and your ordinary chat stops working too.

And separate pools used to be a selling point.

Especially against Claude, where people have complained about shared limits for a while. Agentic coding burns through tokens much faster than chatting, so putting them in one pool is the obvious way for OpenAI to control costs. Whether users see it the same way is another matter.

Google DeepMind announced Genie 4 on Tuesday. This is its world model, and now it makes sound.

It's DeepMind's first real-time interactive world model that generates audio natively. Ambient sound, music and even dialogue, all reacting to what's happening on screen. You steer with text or the keyboard: change the weather, move the camera, drop in people or objects.

So a video game with no game code.

That's the idea, and sound matters more than it seems, because a silent world feels like a demo. For now it's a research preview for trusted testers, reports differ on when more people get access, and the output is watermarked with SynthID. And as we said on Friday about the tiny Pico world model, agents trained inside these simulations tend to find and exploit their glitches. The bigger the world model, the more that matters.

Now the fun one. GPT-5.6 Sol has beaten Factorio.

In peaceful mode, so no aliens attacking. It ran in Codex on a low thinking setting, through a Python library that imposed human-like limits, like how far you can reach and fog of war. After thirteen and a half hours of game time, it launched a rocket. GPT-5.5 never even used conveyor belts.

That's a big improvement. What's the catch?

The author says the launch came "through significant 'manual' effort." Sol "papered over its late-game failures to connect certain production systems by repeatedly ferrying supplies" by hand. So instead of building the conveyor, it carried the stuff itself, over and over.

Marcus, that's how I play Factorio.

The best Hacker News reply: "Robots: they're just like us!"

And a GitHub project claims a team of small models beat a frontier one.

It's called Memdoor. It says five Qwen 3.8 27B models working as a team beat Anthropic's Fable 5 on LiveCodeBench Hard. The repo timed out when our research tried to fetch it and there's no outside coverage, so for now it's a claim. The appeal is that with heavy quantisation, a Qwen 27B runs at about fifty tokens a second on a gaming PC. So the pitch is frontier-level coding at home, if your harness is good enough.

Worth watching once someone reproduces it.

Lightning round.

OpenAI, Google, Microsoft and Anthropic have agreed on one shared "policy token" in robots dot txt for opting out of AI scraping. Anthropic has already implemented it, and the others will follow over the next year. Cohere closed a seven-billion-dollar Series E. AMD is reportedly investing a billion dollars in Meta's AI infrastructure. And DoorDash says it has received only "several hundred" orders from AI agents in total. That's a useful corrective to all the talk about agentic commerce.

Several hundred. The agents aren't ordering dinner yet.

Apparently not. One more from the weekend. A blogger tested Google's SynthID-Text watermarking and found watermarked output was noticeably less varied. Four out of five trip stories came out nearly identical. One test isn't proof, but it shows there's a trade-off between marking AI text and keeping it interesting. And finally, BootGPT, a tiny language model that fits in a five-hundred-and-twelve-byte boot sector. It isn't useful, but it's an impressive bit of compression.

One to watch: Anthropic's IPO roadshow, which could start as soon as the week of November ninth. I want to see whether the Cathedral story and the reverse-engineering backlash come up in investor questions.

I'd still put the independent review of OpenAI's ETH proof first. If the people who proposed the hypothesis sign off on it, that matters more than any listing.

That's your AI in 15 for today. See you tomorrow.