Part 3 of Volexity's 'Mind the (Patch) Gap' series (Oct 16) shows analysts using OpenAI's Codex client with GPT-6.1-Sol, connected to Volcano's new MCP server, to confirm IOC hits tied to the September Chrome/Windows zero-day chain, label UTA0560 and GRIMWEDGE artifacts, write query, string and YARA IOCs (including JungleBamboo), and schedule targeted collections on endpoints. Re-running the IOCs turned up GRIMWEDGE-encoded JavaScript in free memory, which Volexity says EDR can't see. It's a vendor product demo, and Volexity notes results vary with model strength. The takeaway for defenders is that agent-driven DFIR is moving into commercial tools, so give a forensics MCP server the same scoping and audit trail as any privileged agent tool.