AI Daily: Infostealer Profiles Victims with LLMs, Orkas Coordinates 16 Agent Types

Today's AI world delivered several intriguing stories at once: attackers are starting to embed LLMs into infostealer pipelines, an open-source project is trying to coordinate multi-agent collaboration through an "orchestrator" role, and GPT-5.6 Sol ran a 13.5-hour peaceful-mode game of Factorio. Efficiency and risk are accelerating along the same track.

A New Job for Infostealers: Letting LLMs Profile Victims

Cisco Talos analyzed an infostealer called VOLTA. Its approach differs notably from traditional trojans: it first steals credentials, artwork, and wallet data, then hands the organized material to an LLM to profile victims by potential monetization value. AI here is not doing the intrusion—it handles the analysis and ranking after the theft.

The research also uncovered a detail: when a model refuses to comply, the sample switches to other models and keeps trying. This means attackers already treat "model refusal" as an engineering obstacle to work around, not a security boundary. For developers and gamers, the risk goes beyond password leaks: logged-in art platforms and wallet accounts are equally exposed.

Restraint is warranted: Talos analyzed a specific sample, and this cannot be generalized to say all malware has these capabilities. But it at least points in one direction: LLMs are being used as a general-purpose tool in the data-processing stage, including within criminal chains.

An infostealer is a type of malicious program whose primary goal is to bulk-collect credentials, cookies, session tokens, and cryptocurrency wallet data from endpoints. Unlike ransomware, it usually does not encrypt files; instead, it completes data exfiltration quickly while the victim is present, then packages the stolen data for sale on underground forums or darknet markets. Traditional infostealer output is often raw files organized by source directory, leaving buyers to filter manually. Samples like VOLTA place an LLM in the post-theft analysis stage, essentially automating the "data sorting and valuation" step that previously relied on human labor, thereby improving the monetization efficiency of a single intrusion. This is also why security researchers are paying attention: the bottleneck in the attack chain has shifted from intrusion methods to post-processing capability.

Patched Vulnerability: Share Links Could Once Bypass the Sandbox

The Parameter research team disclosed another issue fixed this week: a malicious ChatGPT public share link could cross the original sandbox boundary via cross-window messages and web components to read another account's private conversations. The team says OpenAI confirmed on October 26 that both web frontends were fixed.

The correct way to read this is to focus on the design level—how message receivers verify origins and how sending windows are isolated. Describing it as "accounts can still be hijacked arbitrarily" is inaccurate, and there is no evidence of large-scale user leakage. The vulnerability is fixed, but the trust model of cross-window communication deserves a fresh look from every team building embedded AI interfaces.

A sandbox here refers to the isolated execution environment browsers create for pages from different origins, centered on the origin model: only same-origin pages can freely access each other's DOM and storage. Public share links are typically rendered in a separate subdomain or window and should theoretically not be able to read session data from the main app or other accounts. Cross-window communication relies on mechanisms like postMessage, and that API does not verify sender identity by default—the receiver must check event.origin and event.source itself, otherwise any window could forge messages. So-called web component boundary escapes often involve custom elements, iframe nesting, or trust propagation in rich-text rendering. Therefore the fix for such vulnerabilities usually focuses not on encryption strength but on tightening message-origin validation and window isolation policies.

Game AI: GPT-5.6 Sol Clears Peaceful-Mode Factorio

Ryan Madden's new experiment had GPT-5.6 Sol in Codex complete a one-star peaceful-mode game of Factorio at a low thinking setting, taking 13.5 in-game hours. The model operated the game through a Python management library and was still constrained by character reach distance and fog of war.

This is not a finished NPC plugin—some late-game production line connections failed, and the model remedied this by repeatedly hauling materials. There were no enemies, and it was not a general clear test of directly watching the screen. Its value lies in providing a sample for observing long-horizon planning: how a model maintains continuous decision-making for over ten hours under resource constraints, spatial limits, and failure feedback.

Open Source: Orkas Coordinates 16 Agent Types with an Orchestrator Role

This week the Weibo open-source project Orkas entered the Gatehub daily chart. It uses an orchestrator role to break down tasks and coordinate 16 built-in roles, and can also call external tools like Claude Code, Codex, and Open Code, with tasks, projects, and deliverable files kept on a desktop workspace.

The phrase "local-first" is easy to misunderstand: it refers to how the app and data are organized, not that model inference is automatically offline. Cloud models still require network access and cost money, the packaged version requires an account, and automated tasks will not continue after the computer is shut down. For teams that want to keep multi-agent workflows local, this is a combination worth trying—but the cost structure should be calculated in advance.

An "orchestrator" in multi-agent collaboration is a scheduling pattern: an upper-layer agent is responsible for task decomposition, role assignment, and result aggregation, while specialized lower-layer agents handle only the subtasks assigned to them. Unlike a single model repeatedly calling itself, the key is explicit task state and role boundaries, which reduce context bloat and mutual interference in long tasks. Common implementations include structured dispatch based on tool calls, shared blackboard-style memory, and workflow engines with retries and rollback. "16 built-in roles" means preset responsibility templates for decomposition, retrieval, coding, review, and more—but it also brings scheduling overhead and error-propagation risk: misjudgments at the orchestration layer get amplified downstream, so logging and human intervention points matter just as much in engineering.

Education Open Source: OpenMAIC from Tsinghua's MAIC Team

Another project on the chart is OpenMAIC from Tsinghua's MAIC team, which splits course generation into two steps—outline and scene content—organizing lecture roles, voice, whiteboard, and interactivity. Course authors can continue editing slides and export to PPTX or HTML, and the repository also showcases a 3D interactive molecular classroom.

Generated content still needs teacher verification, models and voice services need configuration, and video export depends on separate Chromium and FFmpeg rendering services. In other words, it is an editable production pipeline, not a magic one-click course button.

PPTX is a presentation format under Microsoft's Office Open XML specification, with content organized as a compressed package of multiple XML parts such as slides, layouts, themes, and media. Programmatic export therefore requires correctly generating relationship files and content-type declarations, or the file will error on open. HTML export typically uses a web slide framework that renders each page as a paged DOM structure, convenient for direct browser playback and further editing. Video export relies on a headless browser taking frame-by-frame screenshots combined with audio-video encoding: Chromium handles rendering and FFmpeg handles compositing, which is why the repository requires separate rendering services—the process is sensitive to compute, fonts, and graphics environments, and is hard to complete purely in the frontend.

Industry: Proton Cancels "Explain Your AI Use" Interview Arrangement

404 Media reported that Proton canceled an interview-style arrangement requiring employees to explain how they use AI. The reporter cites employee interviews and a recording of an internal all-hands meeting, but AI use may still enter performance reviews, and employee opinions on the change are mixed.

This involves how efficiency requirements, communication approaches, and engineering safety are coordinated when companies adopt AI. One should not write the cancellation of interviews as the company fully abandoning AI, nor conclude that layoffs have already occurred. It looks more like an adjustment of management tactics than a directional shift.

Policy: Opposing Public Funds to Bail Out AI Companies

U.S. Representatives Kaiser, Waters, and others introduced a resolution opposing the use of public funds to bail out insolvent AI companies and related executives, advocating that support focus on workers, retirees, and low-income groups. This is a resolution and policy stance introduced by lawmakers—not a law that has passed, nor the cancellation of any specific bailout.

It reflects a heating debate: who bears the risk of AI investment. When industry investment is measured in hundreds of billions of dollars, this question will not stay confined to parliamentary texts.

Summary

Today's stories point to the same fact: AI capabilities are permeating every existing system—criminal chains, vulnerability attack surfaces, games, corporate management, and public policy. Each requires distinguishing between "what has happened" and "what might happen," and that is the sense of proportion most worth preserving when reading AI news.