OSINT (Open Source Intelligence) is a very time consuming process with plenty of dead ends, but the main time sink is the variety of tools, sites and APIs an investigator needs to navigate. The process is iterative and after many failures a single piece of information can lead you to a fresh reservoir of information. People often guard their information in concentric circles, they may have blank social media accounts from which they can post what they want without it being connected to their real identity. They then have their social media accounts that are actually linked to who they are, linkedin, facebook being prime examples.
When these worlds cross, things happen. Like the time this white GOP nominee said he was a 'black gay guy'. This blunder happened because Mr Browning forgot which account he was logged into, and as he was a politician it was picked up on almost immediately. Many people without such a large audience may have done this multiple times and never realised, but searching their social media accounts on google with `site:"tiktok.com"` may reveal sensitive identifying information the subject doesn't even remember they published. I have used this technique to great effect many times to link supposedly separate accounts together.
How can AI help with this process?
Processing all this data and looking for relevant results can take hours and hours of clicking through similar links and reading pages of comments just to find the one related to the target. LLMs can perform this task orders of magnitude faster and produce summaries of information.
What is MCP?
So far we've talked simply about search engine use but MCP (Model Context Protocol) is a standardised method of giving LLMs tool use. Here is an example of a system prompt explaining an breach checking MCP tool to an LLM and what it might expect to have returned:
FastMCP tools
────────────
check_hibp_breaches(email, ...)
check_hibp_pastes(email, ...)
check_dehashed(email, api_key=None, ...)
search_leaked_passwords(password_hash, ...)
Returns
───────
{
"status": "success",
"email": "[email protected]",
"breaches": [...],
"pastes": [...],
"total_breaches": 5,
"severity_analysis": {...}
}Any number of these tools can be given to an LLM and the key is that they can be called dynamically and iteratively. An LLM may discover an email address in a googledorked PDF `filetype:"PDF"`, and then decide to use a tool like Mosint to find out more information about the email account, or simply perform another search with a search engine tool.
If OSINT practitioners are doing it, we can likely automate at least some of the process with LLMs & MCP. More complex examples include: vision language models for photo analysis and geolocation, and voice agents for calling sources to get more information.
We are in a novel period where we can simply add more tools as we progress without rewriting the stack, because for the first time we have a silicon mind that can parse the information, work out what is relevant and then call the appropriate tools, and they don't need to sleep.
> End of output.