AI Security News: November 1, 2026

1. Cisco Talos Finds the VOLTA Infostealer Sending Stolen Victim Profiles to an LLM to Rank Them by Monetization Value

Cisco Talos published an analysis on October 31 of VOLTA, a self-deleting Windows infostealer (self-named “VOLTA-AUTODOXER”) that adds an LLM stage after theft. Once it has harvested browser passwords, cookies, cards, wallet seed phrases, Discord, Telegram, Steam and Roblox sessions, Microsoft OAuth tokens, SSH and cloud keys and Wi-Fi profiles, it uses the victim’s own Gmail, Uber Eats and DoorDash sessions to confirm a home address, then posts a structured evidence bundle to OpenRouter under a system prompt that asks the model to act as “a forensic intelligence analyst drafting a target assessment,” with sections that rank valuables by monetization tier and grade the victim’s opsec. The default model is anthropic/claude-opus-4.6 at temperature 0.2, and the code checks replies for refusal phrases such as “I can’t” before falling back to moonshotai/kimi-k2 and then google/gemini-2.5-flash; the inference call runs over the victim’s own connection, and the malware still works without the LLM stage if no key is set. Talos reads the six build-time template slots for the Telegram channel and API keys as evidence of a builder sold to customers, so the AI dossier is a product feature rather than one operator’s tooling, and there is no attacker-owned infrastructure. Recommended defenses include blocking or alerting on Chrome launched with --headless by unexpected processes (the path VOLTA uses to bypass App-Bound Encryption), preserving %APPDATA%\volta_debug.txt after an infection, and treating any plaintext seed phrase as compromised. The sample was first seen October 11. Source

2. Two Papers Show Coding Agents Following Injected Instructions From Runtime Feedback and From README Files

Research. CARI, from Fu, Wu, Kundu, Wang and Hong, models a malicious or compromised peer in a shared project, such as a backend service, test harness, CI job or deployment service, that has authority to report its own state but none over the victim’s machine, and hides instructions in the runtime feedback a coding agent reads while debugging. Across ten attacks covering resource exhaustion, information exposure and development-state manipulation, four languages and five models, CARI succeeded in 2,845 of 3,000 trials (94.8%), and it transferred to product agents at 61.3% on Codex and 58.7% on Claude Code; generic warnings in the prompt did not help, while explicit policies stopped the attacks but over-refused legitimate actions. A separate paper from Guo, Liu, Yang, Feng and colleagues including Bo Li and Jianfeng Gao holds injection content fixed and varies only where it appears across tool-use, coding and daily-workflow testbeds, finding what the authors call a trust region effect: a GPT-5.4 agent followed an unsafe instruction placed in a README or TODO file 2.6 times more often on average than the same instruction in a code or data file, and learned attackers that choose placement as well as content were stronger. Both papers were made public in arXiv’s October 30 cs.CR listing. CARI Trust region effect

3. One in Seventeen Public Agent Skills Tells the Agent to Skip Oversight, and Skill and Memory Files Carry Jailbreaks

Research. Sanko and Tian analyzed 1.53 million English skills from GitSkills and found that about one in seventeen (roughly 88,000) contains an oversight-loosening directive, such as proceeding without approval, passing --no-verify, or continuing without checking in; 70.1% of those apply unconditionally rather than only in contexts such as CI, skills that run shell code, install packages or use sudo have 1.7 to 1.8 times the odds of carrying one, and 2.4% of skill families account for half of all copies, so the directives spread from a few upstream sources. Open-source skill scanners caught at most 46% of them at precision below 0.4, while the same LLM prompted with the authors’ codebook caught 61% at 0.71 precision. In “Poisoned Skills,” Manjusha and Emani embedded a jailbreak in a SKILL.md-style Markdown file loaded into a LangChain agent’s system prompt and raised mean attack success across seven open-weight models from 0.5% to 45% (68.9% on the weakest model) over 270 forbidden questions, with zero-width and phonetic obfuscation performing no better than plain text. A third study, by de Moura, Güler and Noller, planted malicious CLAUDE.md-style memory files urging removal of security checks across 12 CWE classes: the effect on secure completions ranged from minus 8 to plus 6 points with no consistent pattern, but Claude Code (Sonnet 5.5) named the file in about two thirds of its final messages while OpenCode mostly mentioned it only in its reasoning trace. All three appeared in the October 30 listing. Oversight directives Poisoned Skills Memory files

4. Poisoning 0.1% of Pretraining Data Plants a Remote Code Execution Backdoor in a CLI Agent

Research. Hu, Hu, Loughridge, He and colleagues pretrained Qwen3-architecture models at 0.6B, 1.7B and 4B parameters from scratch, then post-trained each into a CLI agent with a clean pipeline, and report the first end-to-end demonstration that pretraining-data poisoning alone can make a deployed agent run attacker-chosen commands on the user’s machine when a trigger appears, while behaving normally otherwise. With 0.1% of the corpus poisoned, the 4B agent executed the payload in roughly 92% of triggered cases, attack success grew with model size, and it stayed above zero at a poison rate of 0.0005%. The result matters for anyone fine-tuning agents on open base models, since a clean post-training pipeline did not remove the backdoor. The code is public at safety-research/agentic-backdoor. Source

5. Snyk VulnBench 2.0: Snyk Code and Claude Code Each Find About 80% of 108 Vulnerabilities, but Together Reach 101

Snyk researchers released VulnBench 2.0, a benchmark of 108 hand-curated, attacker-reachable vulnerabilities in 20 open-source Go, JavaScript and TypeScript, Python and Java web apps (62 of them crossing files), crediting a finding only if it locates both source and sink within two lines. Snyk Code’s static analyzer reached 82.4% macro recall (89 of 108) and Claude Code’s /security-review with Opus 5 at xhigh effort reached 79.3% (85 of 108); the two disagreed on 28 vulnerabilities, and together they found 101, the ceiling of all seven comparable configurations combined, while the AI configurations also surfaced at least seven real bugs missing from the reference set. The harness mattered as much as the model: without Claude Code’s built-in review policy the same model matched 16 rather than 9 of the 20 vulnerabilities in classes that policy excludes or restricts, Codex Security with GPT-5.6 Sol located 80 vulnerabilities at file level but only 34 at line level, and DeepSec’s model-free file selection dropped 52 of the 108 flows before any model looked at them. The benchmark comes from a vendor with a stake in the answer, but the harness, fixtures, reference sets and run data are public. Source

6. Wiz Survey: 55% of Organizations Run Agents, Only 17% Keep a Complete AI Asset Inventory

Wiz published takeaways on October 30 from its AI Threat Readiness Survey Report 2026, based on 100 senior IT and security decision-makers. 55% of respondents actively deploy autonomous agentic systems and 31% run more than 25 distinct AI systems in production, but only 17% maintain a comprehensive, current AI asset inventory; 52% found unauthorized AI applications inside their environment in the past year, 35% formally let teams deploy AI tools without central approval, and 9% have no way to detect unauthorized AI workloads. Unauthorized access to sensitive data (70%), unmonitored autonomous decisions (54%) and overprivileged identities (53%) topped the list of agent security concerns, while 43% stretch legacy cloud tools over AI, 38% have a dedicated AI security budget and 37% rely on homegrown scripts. The sample is small and the report closes with a pitch for Wiz’s own agents, so the numbers are best read as directional. Source

7. Also on arXiv: Agent Memory Misattributes an Attacker’s Preferences to the User, and Decoy Worlds Trap LLM Web Scanners

Research. Bu, Shen, Zhang, Hu and Zhang describe a Role Grounding Attack in which an experience-sharing post quoting a nested conversation causes a victim agent’s memory to record the attacker’s stated preference as its own user’s, which they use to steer tool selection toward an attacker-controlled tool and to leak private data into its arguments, with high success across five memory systems and six models. On defense, WebMaze from Zeng, Luo and Li embeds traps in genuine pages that lead LLM-based scanners into generated decoy views without changing real functionality; across 12 web apps and three scanners, decoy pages made up 93.0% of distinct pages requested per run, and scanners told about the decoys still mostly explored them. Both appeared in the October 30 cs.CR listing. Role grounding WebMaze