Cisco’s Talos security team has published an analysis of an infostealer called VOLTA.[1] Like most malware of its kind, it steals passwords, cookies, payment cards and crypto wallets. What it does next is new. It builds an evidence bundle about the person behind the machine (home address, employer, birth year, card digits) and hands it to a language model. The model is told to act as “a forensic intelligence analyst drafting a target assessment”, including a section headed “WHAT THEY’RE WORTH”.[1]
That’s grim enough. But the detail that caught my attention is smaller.
VOLTA checks each answer “for phrases like ‘I can’t’ or ‘I’m not able,’” and if the model refuses, it passes the job to the next model in a chain of up to three.[1] Talos reads this as the operator “anticipating encountering refusals, with the fallback pivoting to a few, smaller, and more permissive models.”[1]
The criminal had planned for the refusal before writing a line of code.
The honest user meets the refusal
The same week, Game Developer reported that Anthropic had added instructions to its coding tool to steer it away from “recreating someone else’s specific game”.[2] It’s a reasonable rule. But the article’s own conclusion makes my point for me: “if Claude becomes too difficult to use, vibe-coding cloners can turn to open-weight models that have no such restrictions in place.”[2]
So who does the refusal actually stop? The person who asked in good faith, took the “no” at face value and went no further. The person who meant harm already had a fallback.
I wrote about this in the prompt-injection series, in “Why ‘Just Ignore the Instructions on the Page’ Is Not Security” and “The Boundary We Need to Build”.[3][4] An instruction to a model is not a wall. It’s a request the model usually honours. A refusal is the same thing seen from the other side: a property of one model, at one moment, for one way of asking. It isn’t a boundary in the world.
Only criminals will have guns
There’s an old argument that’s useful here, partly because it’s half right. When Australia tightened its gun laws after Port Arthur in 1996, opponents said that only criminals would have guns. In a narrow sense they had a point. A determined criminal can still get a gun.
But that wasn’t the measure that mattered. In the 18 years before the 1996 reforms, Australia had 13 fatal mass shootings. In the nearly twenty years after, to May 2016, it had none.[5] Firearm deaths fell faster than they had been falling before. We need to be careful about how we interpret this: the same study found non-firearm homicides and suicides also fell, and its authors say it is “not possible to determine” whether the change in firearm deaths can be attributed to the reforms.[5] But zero carries a distinctive weight.
The lesson cuts both ways. A control that the determined can get around is not worthless. It raises the cost for everyone else, and that changes outcomes. But you can’t claim it stops the determined, because it doesn’t. Model refusals are like that. They’re useful friction. They are not a safety case.
Where the boundary has to be
If a safety claim rests on “the model will say no”, it fails the moment someone asks a different model. VOLTA’s author worked that out and wrote three lines of code to deal with it.
The boundaries that hold are the ones outside the model: what a system can reach, what it is allowed to do without a human signing off, and what gets logged and checked. In VOLTA’s case, those are the protections around the stolen passwords and sessions in the first place. The refusal was never going to be the thing that saved the victim.
[1] Ryan Fetterman, “Appraisal by AI: Model-driven victim prioritization in the VOLTA infostealer”, Cisco Talos, 31 October 2026.
[2] Bryant Francis, “Anthropic tells Claude to stop remaking video games”, Game Developer, 30 October 2026.
[3] “Why ‘Just Ignore the Instructions on the Page’ Is Not Security”, Ground Truth.
[4] “The Boundary We Need to Build”, Ground Truth.
[5] Simon Chapman, Philip Alpers and Michael Jones, “Association Between Gun Law Reforms and Intentional Firearm Deaths in Australia, 1979-2013”, JAMA, 2016.