Intrinsec AI Agents X Digital Forensics series

CERT Intrinsec maps where autonomous coding agents leave evidence on disk; the same session databases and token files an investigator needs are a credential-collection target

Autonomous coding agents now run shells, install helpers and reach networks on developer and build endpoints, and this pipeline has already covered a case of one standing up a reverse tunnel and installing persistence on a real macOS developer machine. CERT Intrinsec's contribution is the responder-side counterpart: where these tools actually leave evidence (CERT Intrinsec, 2026-07-27, CERT Intrinsec, 2026-07-31).

For OpenCode, an open-source agent shipped as a CLI, desktop application and IDE extension, configuration lives in a per-user opencode directory whose opencode.json records how the agent was set up. The artefact that matters most is a SQLite database, Intrinsec calls opencode.db "the most valuable artifact", "a SQLite database storing sessions, messages, projects, workspaces, etc." Its message table distinguishes model responses from user prompts by whether a timing field is present alongside the text, so an investigator can reconstruct both halves of a conversation and bound each response in time. A separate file in the same tree holds authentication material: "This file contains authentication information such as API keys."

For OpenAI's Codex CLI the shape is the same with different names. Everything sits under a per-user .codex directory; auth.json carries authentication information including API keys and access tokens; history.jsonl carries the list of user prompts; and per-session rollout logs record the session itself, including token-usage events that report input, cached-input, output and reasoning-token counts for the session and for the most recent response, plus the model's context window. That last detail is more useful than it first appears, it lets a responder estimate how much material an agent session actually processed without having to reconstruct the content.

The dual reading is the point. For incident response this is a map of where to look when a coding agent is implicated in an intrusion, and the prompt history is unusually valuable evidence because it records operator intent directly rather than by inference. For threat modelling it is an inventory: an attacker who reaches a developer workstation or a CI runner with any code execution finds provider credentials in cleartext JSON at a predictable per-user path, together with a transcript of what the organisation has been building. Neither file requires privilege escalation to read if the attacker already has the user's context.