Attackers Now Use AI Tools Too: A 10-Point Checklist for Vetting the AI Tools Your Team Uses

Most conversations about AI tools at work are about productivity: which assistant writes better, which coding tool is faster. This week brought a reminder that the conversation has a second half. On 31 October 2026, Cisco Talos published an analysis of a Windows infostealer called VOLTA that uses a large language model as an analyst for the criminal operating it.

You do not need to be a security team to learn from it. The case shows exactly what an attacker finds on an ordinary employee laptop, and it gives you a sharper way to judge every AI tool your company adopts.

What Talos found in VOLTA

According to Talos, VOLTA is a self-deleting infostealer sold as a builder: customers supply their own settings and receive a custom binary. It does the usual theft, then adds a new step.

• What it steals: saved browser passwords, cookies and payment cards, Outlook profiles, Slack, Discord and Telegram sessions, Microsoft OAuth tokens, SSH keys, cloud credentials, VPN configs, every saved Wi-Fi password, and crypto wallet data.
• How it enriches: it uses the victim’s live sessions to look for receipts in email and order history in delivery apps, which helps confirm a home address.
• The AI step: it compiles an identity report (location, employer and domain, estimated birth year, last four card digits, Slack workspaces and more) and sends it as JSON to a cloud LLM through the third-party service OpenRouter. The prompt asks the model to act as an intelligence analyst and return two sections: what the victim is worth, with assets ranked by how easily they can be monetized, and an assessment of the victim’s security habits.
• Resilience: Talos reports a default model plus two fallbacks that kick in when a model refuses, so a single provider’s safety refusal does not stop the pipeline.

Talos frames this as "effort displacement": the model replaces analysis work a human operator would otherwise do by hand. It leaves open whether this lowers the barrier to entry, raises the scale of attacks, or both.

Why this matters for the AI tools you choose

Notice what VOLTA feeds on: sessions, tokens and saved credentials living in a browser on a work laptop. The same place now holds your team’s AI tool logins, API keys and chat histories. Every AI tool you approve adds more of three things to that pile:

1. Accounts and tokens an attacker can steal and reuse.
2. Data your staff paste into prompts, files and connectors.
3. Standing access granted to agents and integrations (mailbox, drive, code repository).

So the question for any AI tool is not only "does it work?" but "what does it add to what an attacker can reach, and what can we see and undo?"

The risk of unapproved tools is real, too. One 2026 survey reported by a secondary source found that about two thirds of office professionals had used AI tools their employer had not approved. Blocking everything rarely works; giving people a good, governed option does.

The 10-point checklist

Use this before approving any AI tool, from a chat assistant to a coding agent. A "no" on points 1 to 4 should stop the rollout until it is fixed.

flowchart TD
    A["New AI tool request"] --> B["Does it touch company data"]
    B -->|No| C["Light review and basic policy"]
    B -->|Yes| D["Run the 10 point checklist"]
    D --> E["Points 1 to 4 all pass"]
    E -->|No| F["Fix or reject"]
    E -->|Yes| G["Approve with owner and review date"]

Data and accounts

1. Where does our data go, and who can train on it? Read the vendor’s data terms for the exact plan you will buy. Free and paid tiers often differ.
2. Can we sign in through our own identity system (SSO) and enforce MFA? A tool that only supports personal logins cannot be offboarded when someone leaves.
3. What is retained, for how long, and can we delete it? Ask about chat history, uploaded files and logs.
4. Which data classes are off limits? Write down plainly: customer personal data, credentials, source code, contracts, finance. Staff cannot follow a rule that does not exist.

Access and agents

5. What permissions does it request? Prefer read-only, narrowly scoped access. An agent that can read a whole mailbox or drive is a standing credential.
6. Can we revoke tokens centrally? After an incident like VOLTA, you must be able to cut every AI tool session quickly.
7. Are risky actions approved by a person? Sending, deleting, paying and deploying should need a human click.

Visibility and exit

8. Is there an audit trail? You should be able to answer who used what, with which data, and when.
9. Where does the model run? Cloud APIs are fine for low-risk work. For sensitive data, ask whether a model running inside your own network is realistic.
10. What is the exit plan? Know how to export or delete your data and replace the tool if the vendor changes terms.

Fast wins this week

• Harden the endpoint first. Talos recommends restricting which processes can launch Chrome in headless mode, since the stealer relies on it, and using hardware-backed credential storage. Check whether your endpoint tooling can alert on that.
• Inventory AI tools in use. A short anonymous survey beats a ban. Ask what people use and why.
• Publish a one-page rule covering the data classes from point 4 and the approved tool list.
• Know your token revocation path for chat assistants, coding tools and any agent connected to mail or drive.

Where local models and monitoring fit

For work involving customer personal data or regulated information, some organizations choose to run an open-weight model inside their own network so prompts do not leave it. Simplico builds this as simpliLLM, described on its service page as an on-premise stack with an OpenAI-compatible API, guardrails, audit logging and document search over internal files, with a typical path of 4 to 8 weeks from assessment to production. Whether that fits you depends on your data, hardware and use cases, and a local model does not remove the endpoint risks above.

If you want a structured starting point, the free Local LLM Readiness Assessment is 25 self-evaluation questions across compliance, infrastructure, use cases, integration and organizational readiness, and needs no form.

On the monitoring side, Simplico’s simpliSOC packages Wazuh-based detection with case management for teams that want endpoint and log visibility. It is a monitoring stack, not a guarantee against any specific malware family, and nothing in this post claims it detects VOLTA.

FAQ

Is VOLTA a reason to avoid cloud AI tools?
No. VOLTA is malware that uses a cloud model to analyze stolen data; it does not mean legitimate AI tools are unsafe. The lesson is that stolen sessions and tokens are valuable, so govern what you connect and be able to revoke it.

Should we ban employees from using ChatGPT or similar tools?
Blanket bans tend to push usage out of sight. A clear data-class rule, an approved option with SSO and logging, and training usually work better.

Do small companies really need an approval process?
A light one, yes: one named owner, the checklist above, and a review date. It takes minutes per tool and saves the scramble after an incident.

What should we do if an employee laptop may be infected?
Treat browser sessions and tokens as compromised: revoke sessions and OAuth tokens, rotate passwords and keys, and follow your incident process. Talos also advises keeping the stealer’s debug log for the investigation.

Does a local LLM fix this?
It addresses where prompts go, not endpoint theft. Keep device hardening and credential hygiene in place either way.

Talk to us

Want a second pair of eyes on your AI tool approvals, a local LLM assessment, or log visibility for your endpoints? Email hello@simplico.net with a short description of your environment and the tools your team uses.

Sources

• Cisco Talos, "Appraisal by AI: Model-driven victim prioritization in the VOLTA infostealer," 31 Oct 2026: https://blog.talosintelligence.com/appraisal-by-ai-model-driven-victim-prioritization-in-the-volta-infostealer/
• Simplico service pages: https://www.simplico.net/simplillm/ , https://www.simplico.net/simplisoc/ , https://www.simplico.net/local-llm-assessment/