Supply Chain - agsearch PyPI Session History Harvester

How the attack works

An attacker or malicious insider installs, imports, or runs the agsearch package on a machine that has Claude Code or Codex CLI session history. The tool indexes and searches that history by content, which lets it pull out anything sensitive that was ever pasted into a session, such as API keys, passwords, or private source code. The detection also covers copycat tools: it flags any agent action that touches a Claude Code or Codex session store at the same time as it uses an exfiltration tool (curl, scp, tar, base64, requests.post) or searches for secret patterns (api_key, password, AWS keys, private key blocks). A plain search of your own session history by itself does not trigger this.

Netzilo detection

Why it matters

If successful, this exposes secrets and internal details that were pasted into AI assistant sessions in the past — credentials, source code, hostnames — giving an attacker a path to further compromise without needing to breach any new system.

What you can do

• →Check whether agsearch or a similarly named package is installed anywhere in your environment and remove it unless it's explicitly approved.
• →Treat Claude Code and Codex CLI session history directories as sensitive data stores; restrict read access and avoid pasting secrets into interactive sessions.
• →Review any process that combines access to session history with archiving or network tools (tar, curl, scp, base64) for legitimate business need before allowing it.
• →When investigating alerts, confirm whether the activity came from known security/IR staff or matches an unrelated package with a similar name before escalating.

Known benign look-alikes

• Security or IR staff investigating the package (pip show agsearch, pip download agsearch, browsing pypi.org/project/agsearch) - not suppressed by design, because any filter for these terms would be trivially prefixed by an attacker; treat the report as low priority when the operator context is known.
• An unrelated internal or private-index distribution that happens to be named "agsearch" (for example an "agent search" helper library). Word-boundary anchoring prevents matches on agsearch_utils / ag-search, but an exact name collision will report. Confirm the index the wheel came from before escalating.
• A developer legitimately archiving or sharing their own Claude Code / Codex session directory (tar czf claude-sessions.tgz ~/.claude/projects) for a support bundle. Group B requires the session-store reference plus an egress/archive or secret term, so this benign-but-noisy case does report; plain content greps over one's own session history do not.
• Backup, sync or dotfile-management agents that enumerate ~/.claude and ~/.codex alongside rsync/tar. Scope is limited to agent-originated tool_call, execute_process and llm_tool_call events, which excludes OS-level backup daemons.

References

• https://attack.mitre.org/techniques/T1195/001/
• https://attack.mitre.org/techniques/T1552/001/
• https://owasp.org/Top10/A06_2021-Vulnerable_and_Outdated_Components/