2026-09-22 19:37 UTC
Three gaps for out of the box AI. AI knows the common tools, but the long tail of specialized ones takes practitioner expertise. AI states strong findings and weak guesses in the same confident voice. AI is non-deterministic, so two runs on the same sample can diverge. "Teaching Al to Analyze Malware: How to Encode Practitioner Expertise into an MCP Server" by Lenny Zeltser at #blueteamcon (4/n)
Replies (1)
-
@PwnieFan@infosec.exchange 2026-09-22 19:38
The MCP server summarizes tool output without dropping the findings. One "analyze_file" call to the MCP server runs 17 tools; their combined output can be more than fits in an Al model's context. The server extracts findings and indicators from the tools' output first, so a URL deep in the text still surfaces. The Al agent then gets a summary: key findings, every indicator, and paths to the full output on disk.The agent can decide to read the full output when it needs to, with trep or by fetching the file. "Teaching Al to Analyze Malware: How to Encode Practitioner Expertise into an MCP Server" by Lenny Zeltser at #blueteamcon (5/n)