Your default analysis mode and response format are configurable in Settings. See Personalization to set the mode new conversations start in.
Ask Mode
Ask mode is a conversational Q&A interface. You type a question, and the AI responds immediately using its knowledge of your uploaded sample and triage results. Best for:- Quick triage questions (“Is this file packed?”, “What do these YARA matches mean?”)
- Conceptual explanations (“How does process injection work?”, “What is a PE import table?”)
- Discussing findings from a previous Agent mode analysis
- Uses Kimi K2.6 (served via Fireworks AI) for fast, low-latency responses, with Claude Sonnet 4.6 as fallback
- Does not execute any tools or access the sandbox
- Draws on the triage data (hashes, YARA matches, entropy, binary type, static analysis) already collected for your sample
- Rate limited to 60 requests per minute
Agent Mode
Agent mode gives the AI autonomous control over a full analysis toolkit. It decides which tools to run, executes them inside an isolated sandbox, reviews the output, and iterates until it has enough information to answer your question. Best for:- Deep static analysis (“Decompile the entry point and trace the execution flow”)
- IOC extraction (“Find all network indicators in this binary”)
- Detection engineering (“Generate a YARA rule for this malware family”)
- Full reports (“Produce a comprehensive threat intelligence report”)
- Uses Kimi K2.6 (served via Fireworks AI) for reasoning and tool selection (Claude Sonnet 4.6 as fallback)
- Each analysis runs inside a fresh E2B microVM (8 GB RAM, 4 CPU cores) with network disabled
- The agent can chain multiple tools together across iterations
- Ghidra projects persist across messages within the same chat session, so follow-up questions reuse the already-analysed project
- The agent can auto-continue analysis across multiple steps when a single response isn’t enough
- Rate limited to 20 requests per minute
Available Tools (Agent Mode)
When in Agent mode, the AI has access to the following tools:Core Analysis
Reverse Engineering
Dynamic Analysis
Document Analysis
Threat Intelligence
Output
Watching an Agent Run
In Agent mode the response streams live so you can follow the agent’s progress:- Tool status - Each tool the agent runs shows its current state: executing, completed, or error.
- Reasoning - The agent’s reasoning steps stream into a collapsible section as it decides which tools to run and interprets their output.
- Final report - Once the agent has gathered enough information, it assembles the findings into the final report. When the run completes, the reasoning collapses into a pill and the report is shown.
Handling Large Outputs
Some tools can return very large results (for example, archive extraction or verbose syscall traces). To stay within the model’s context window, any tool output larger than roughly 100 KB is capped: the agent receives a truncated preview together with a notice that the output was truncated.Truncation is expected behaviour, not a failure. The agent can still work from the preview and follow up with more targeted calls.
- Narrowing the query (for example, ask about a specific function, offset, or category rather than the whole binary).
- Applying filters so the tool returns only the relevant slice.
- Saving the data as an artifact for download rather than asking the agent to print it inline.
Choosing the Right Mode
Analysis Perspectives
In your settings, you can choose from four analysis perspectives that shape how the AI communicates its findings:- Professor - Educational explanations that teach concepts alongside findings
- Analyst - Balanced technical detail for SOC workflows
- Reverse Engineer - Deep technical analysis with assembly-level detail
- Threat Hunter - TTPs, detection opportunities, and adversary behaviour focus