Security automation provider Swimlane has added customer-defined detections, two-way Model Context Protocol support and a natural-language application builder to its Turbine platform.
The new detection capability lets security teams run their own logic across large datasets and route resulting alerts into Swimlane’s AI SOC workflow for investigation and response. The company is positioning it for emerging risks such as prompt injection, unapproved AI use and compromised guardrails that may not generate alerts in conventional security products.
Turbine 26.5 also introduces two MCP connection patterns. Hero AI can call tools exposed by approved external MCP servers, while outside AI clients can call selected Turbine components through a Turbine MCP server. Administrators choose which tools are available, creating a governance layer between agents and security automation.
That control is important because MCP connections can expand an AI agent’s effective permissions. A compromised prompt or unsafe tool could turn a model-level problem into action across enterprise systems. Swimlane’s documentation says OAuth is not supported for external MCP servers in this release, so security teams should scrutinize the available API key, bearer token and basic authentication options.
The release also adds a Hero AI Application Builder Agent that can create or modify fields, layouts and workflows from natural-language instructions. Faster construction may reduce automation backlogs, but organizations still need change review, least-privilege tool exposure and audit trails for agent-initiated actions.
For SOC leaders, the practical value will depend less on how many agents are connected than on whether detections produce useful evidence and whether every automated action remains attributable, bounded and reversible.
