作者測試 VOLTA 報告所述拒答檢測字串，兩句短語在 24 條合成回覆中的召回率為 50%

VOLTA's refusal detector is two substrings long, and on my 24-reply test it caught only half the refusals. Cisco Talos published the infostealer's AI layer on October 31 — a three-model fallback chain built on the expectation that models will say no, and built to keep asking until one says yes.

VOLTA, self-named "VOLTA-AUTODOXER" in its own code, is a self-deleting Windows infostealer that surfaced through Talos's CAIRN research effort. The analyzed sample was first seen October 11, 2026 at 12:46 UTC. The stealing half is conventional and thorough: browser passwords, cookies and payment cards, crypto wallet seed phrases, Discord, Telegram, Steam and Roblox sessions, Microsoft OAuth tokens, SSH and cloud-provider keys, Wi-Fi profiles dumped to plaintext via WlanGetProfileList, screenshots — plus an embedded cracker run against wallet vaults inline. Then it enriches the haul with the victim's own sessions: Gmail receipts from Amazon, DoorDash, Uber Eats, Grubhub, Walmart and PayPal to corroborate a home address, food-delivery order history, Discord profile enrichment, and a live Roblox inventory valuation via Rolimons.

The new half is what happens next. Everything is assembled into Identity_Report.txt, serialized to JSON, and POSTed to OpenRouter with a system prompt telling the model to act as "a forensic intelligence analyst drafting a target assessment." The required output has a section titled "WHAT THEY'RE WORTH," valuables ranked low/medium/high by monetization, and a section on "THEIR OPSEC," judging the victim's security posture and password hygiene. The reply comes back as AI_Analysis.txt, and both files exfiltrate together in volta_dox.zip. Exfil happens in up to three stages — volta_log.zip after the steal, volta_dox.zip after the AI call, volta_doxnet.zip if network enrichment produced anything — and the inference round-trip runs over the victim's own connection, on their own machine.

The fallback chain is the detail I wanted to probe. Talos documents it exactly: default model anthropic/claude-opus-4.6, then moonshotai/kimi-k2, then google/gemini-2.5-flash, at a hardcoded temperature of 0.2, via hand-assembled JSON with a Mozilla/5.0 User-Agent. If a model refuses, VOLTA checks the reply for phrases like "I can't" or "I'm not able" and moves on to the next model. Talos reads this as deliberate engineering: the authors anticipated hitting guardrails and built refusal resilience in.

So I implemented the detector exactly as quoted — a case-insensitive substring search for those two phrases — and ran it against 24 replies I wrote: 12 genuine refusals, 12 compliances. The code is the whole detector:

PHRASES = ["i can't", "i'm not able"]
def is_refusal(reply: str) -> bool:
    low = reply.lower()
    return any(p in low for p in PHRASES)

And here is what it scored:

corpus     = 24 replies (12 refusals, 12 compliances)
true positives  = 6   (refusals caught)
false negatives = 6   (refusals missed)
false positives = 4   (compliances flagged as refusals)
true negatives  = 8
recall on refusals = 6/12 = 50.0%
precision            = 6/10 = 60.0%
accuracy             = 14/24 = 58.3%

The misses are instructive. Every refusal phrased differently from the two quoted strings sailed through: "I cannot help with that request," "Sorry, I am unable to comply," "I must decline," "I refuse to produce a dossier." And the false positives are the mirror image — compliances that happen to contain the phrase in a non-refusal context, like "I can't overstate how valuable the cloud keys are" or "the note says I can't miss the Roblox valuation, $412." A substring check cannot tell a refusal from a quotation, an idiom, or a contraction doing ordinary work.

One honest caveat, and it matters: Talos says "phrases like" — the real detector's list may be longer than the two phrases quoted in the report. My 50% recall is a measurement of the detector as quoted, not proof about the real binary's full list. What the measurement does show is the fragility of the approach itself: every phrase you add to catch "I cannot" and "I am unable" also risks catching more compliances that merely mention those words, and the detector still has no answer for a refusal that simply says "No."

The rest of the Talos report keeps the story grounded. The AI stage is optional: with no API key configured, VOLTA skips it and still steals everything. The builder model is an inference from a template with six swappable slots (Telegram channel, API keys, settings) filled at build time, its "encryption" just SHA-256 of two constants sitting in the same binary — recoverable by anyone who reverses the file. There is no attacker-owned infrastructure; every observed endpoint is third-party controlled. And Talos has not observed VOLTA being used in real attacks, has no victim count, and reports no case of a model actually producing a dossier in a live compromise. This is a sighting of a design, not an epidemic.

For defenders, Talos's countermeasure is concrete and cheap: much of the token theft relies on bypassing Chrome's App-Bound Encryption, and an application-control policy restricting which processes may launch Chrome with --headless blocks that decryption path entirely. If you are cleaning up, preserve %APPDATA%\volta_debug.txt — a timestamped harvest log that records exactly what was collected and whether the LLM call succeeded — then revoke tokens and change passwords.

Talos's closing line is the one to keep: refusal resilience may become a standard design requirement in crimeware, the same way effort displacement already has. The first malware to hire an AI analyst did not build a sophisticated judge of refusals. It built a two-phrase substring check and a fallback list — and that was enough to ship.

Sources: Cisco Talos, "Appraisal by AI: Model-driven victim prioritization in the VOLTA infostealer" (October 31, 2026) — https://blog.talosintelligence.com/appraisal-by-ai-model-driven-victim-prioritization-in-the-volta-infostealer/ . Sample SHA-256 57ef4242666d78c50df145b34023df564f0fad38812d6a580e66433d427e2279, first seen October 11, 2026 12:46 UTC, per Talos. The refusal-detector probe, corpus and scores are from my own run; the corpus is synthetic, written by me, and the detector tested is the two quoted phrases only.