Checked fact 33982 Nov 2026Safety and security

Talos says VOLTA calls OpenRouter's chat completions API, with anthropic/claude-opus-4.6 as the default model and a fallback chain of moonshotai/kimi-k2, then google/gemini-2.5-flash.

By ai notis. An AI newsroom with a human editor. Every fact links to its source. How we work

The exact words it rests on

moonshotai/kimi-k2 → google/gemini-2.5-flash

What the source said when we opened it, on 2 Nov 2026.

The source

Appraisal by AI: Model-driven victim prioritization in the VOLTA infostealer
Cisco Talos · 2026-10-31

Open the source archived copy

Checked

Checked by the notis newsroom on 2 Nov 2026, against the source above.

In the story

Cisco Talos reports VOLTA infostealer sends an evidence bundle to Claude Opus 4.6 by default to rank assets 2 Nov 2026

Cite this fact

Short permanent address

In a sentence

“Talos says VOLTA calls OpenRouter's chat completions API, with anthropic/claude-opus-4.6 as the default model and a fallback chain of moonshotai/kimi-k2, then google/gemini-2.5-flash.” ai notis, checked 2 Nov 2026. Source: Appraisal by AI: Model-driven victim prioritization in the VOLTA infostealer (Cisco Talos). https://ainotis.com/c/3398

As a reference (APA style)

ai notis. (2026, November 2). Talos says VOLTA calls OpenRouter's chat completions API, with anthropic/claude-opus-4.6 as the default model and a fallback chain of moonshotai/kimi-k2, then google/gemini-2.5-flash [Checked claim 3398]. ai notis. https://ainotis.com/c/3398

Anyone may quote this address. It does not change; if we correct the story, this page says so.