Volexity said on 16 October that its Volcano forensics tool now has an MCP server. MCP, short for Model Context Protocol, lets an AI model use a tool's functions. In a demo, Volexity staged the UTA0560 attack on a virtual machine. Analysts connected OpenAI's Codex client, running GPT-6.1-Sol, to Volcano. In separate prompts, the AI triaged evidence, labelled it, wrote detection rules and scheduled collections from a test Windows server.
The AI built its rules from Volexity's blog findings, indicators Volexity published on GitHub and artifacts it found in the sample. The post does not say whether anyone reviewed them. A later analyst prompt set the plan: collect registry and browser files, wait up to five minutes, and if any new rule fired, collect again with memory added. Volexity planted a test web address in the server's browser, so a rule fired. The first sweep took a couple of seconds. The post gives no error rates or price.
An IOC, or indicator of compromise, is a rule that flags a known sign of an attack. Here, a quick first sweep picked hosts worth a deeper look, and the memory step followed only after a hit. The escalation rule lived in the analyst's prompt wording, not in the AI's own judgment. Buyers can ask who writes that wording and who reviews AI-written rules.