Thieves Use AI and Malware to Rank Stolen Data by Value

Windows malware called Volta combines information theft with AI-assisted assessment. Cisco Talos describes software that collects material from a compromised device, then asks a language model which assets appear valuable. The additional threat is interpretation: turning a collection of stolen details into something an attacker can act on.

The Talos analysis, published October 31, is the lead story in today’s briefing. The episode also covers Claude’s new message threads, OpenAI’s electricity plans and Google’s expanding planning trial.

Listen and follow AI World Today on Spotify or Apple Podcasts. Find earlier editions on the podcast page.

A delivery receipt may establish where a purchase went. A separate message may identify an employer. Neither necessarily proves someone’s wealth or authority. Combined, however, those details could give an attacker a reason to examine a particular account more closely.

That is the difference between possession and interpretation. Collecting a large archive is one task; deciding which parts are useful is another. An automated assessment could reduce the reading needed to form a hypothesis, without making that hypothesis correct.

There is an important limit to the evidence. In WIRED’s interview, the Talos researcher says the team had not tracked whether Volta had been used in the wild. The finding should not be presented as a count of confirmed victims or proof of accurate profiling.

Microsoft’s token guidance explains how services maintain authenticated access without requiring a password on every request. Depending on the service’s protections, stealing usable session information can allow someone to impersonate the signed-in user.

This is why multifactor authentication and device security address different parts of the problem. A stronger login check remains valuable, while an already-authenticated session also needs protection.

Google’s account-recovery guidance includes reviewing security activity and devices, alongside credential and malware checks. A suspected compromise calls for investigating the access that remains open, not simply choosing a more complicated password.

Anthropic’s November 2 message-threads announcement targets long AI sessions. Applications can send the conversation once and upload only new messages afterward. The company says token usage remains unchanged because Claude still reads the conversation.

The distinction separates responsiveness from price. A shorter wait for a reply could help someone finish work sooner, but it does not establish a lower usage bill. The documentation also makes clear that threads are temporary and not eligible for zero data retention.

OpenAI’s Grid Protectors Program, announced November 2, proposes making future campuses more flexible electricity customers. Reducing consumption during a peak can help a grid differently from adding new generation.

An earlier Georgia Power agreement provides for up to 1,000 megawatts of demand reduction at a planned campus. That is a commitment for a facility still in development, not a demonstrated national network or a guarantee of lower household bills.

The UK government says PlanAssist will expand to 15 councils for a twelve-month trial. The tool supports checks and report preparation for planning officers.

DeepMind reports a 58% reduction in assessment-task time during early testing. That measure should not be confused with a guaranteed reduction in an applicant’s total waiting time. Officers retain the decision, and the expanded trial will test the tool on more live applications.