VirusTotal Integrates Threat Intelligence With ChatGPT for Malware Analysis

VirusTotal can now bring threat intelligence into ChatGPT through VirusTotal AI (VTAI), allowing users to investigate suspicious files, URLs, domains, and IP addresses within a conversation.

The connection helps analysts retrieve existing reports and explain detection results while keeping the source, analysis date, and coverage visible.

The integration uses Model Context Protocol (MCP), a standard that connects AI tools with external services. VirusTotal’s ChatGPT connection guide describes setup through Developer mode and an OAuth connection. Users sign in with Google through VTAI without supplying a VirusTotal API key. Availability depends on account and workspace settings.

VirusTotal ChatGPT Integration

For an explicitly authorized ChatGPT attachment, the connector can fetch and hash the original file content. It checks whether VirusTotal already knows that hash before uploading anything.

Known files return existing reports, while only confirmed unknown files are submitted. Creating the connection alone does not prove attachment support works.

This approach separates report retrieval from file contribution. Retrieving an existing report consumes query quota, including repeated lookups and analysis status checks.

At Cybersecuritynews, we have successfully integrated VirusTotal with ChatGPT to enhance our analysis capabilities. Recently, we conducted an in-depth check on a PDF file, and here are the results.

Uploading a confirmed unknown file does not spend that quota, although separate contribution limits apply. Receipt recovery is free, helping users resume interrupted work without resubmitting the same sample.

For network investigations, users can request URL submissions or domain and IP reanalysis when authorized. Keeping each request identifier helps track the registered analysis after an interruption.

These checks extend workflows covered in Cyber Security News’ VirusTotal threat research guide, bringing report review into a conversational interface.

The connection also builds on VirusTotal’s earlier use of AI, including Code Insight for malware analysis. However, threat report access should not be mistaken for a final security verdict.

Missing reports mean the result is unknown. Pending analysis and zero detections do not establish that a file or website is safe.

Privacy remains a concern. Standard submissions share content with VirusTotal and may expose it to security community members and partners. Analysts should obtain permission before submitting personal documents, internal code, credentials, or sensitive data.

Complete submitted URLs can disclose information carried in query strings and fragments, making review before submission essential. According to the VTAI overview, access is free within quotas. Permissions and allowances apply across account connections, not per chat.

For security teams, the benefit is easier access to evidence, not a replacement for investigation. Analysts still need to assess report age, coverage, and context before deciding whether to block, isolate, or escalate.

An EDR alert reveals an attack. But can it tell the full story? Discover how to reconstruct the attack timeline.