Agent Session Store Content Search and Resumption

How the attack works

Attackers (or an AI agent tricked by a malicious instruction embedded in its input) look for text-search or file-processing tools run against the folders where Claude Code or Codex store conversation history, such as ~/.claude/projects, ~/.claude/history, ~/.codex/sessions, or ~/.claude.json. This can take two forms: running a purpose-built tool like agsearch that indexes and searches past sessions by content, or combining a transcript-store path with a generic tool like grep, rg, jq, or a resume/continue flag on the same command line. Either pattern lets someone pull sensitive information out of past agent conversations, or pick up and continue a session that isn't theirs.

Netzilo detection

Why it matters

If successful, this exposes whatever was discussed or shared in prior agent sessions — which can include credentials, internal data, or proprietary code — and can let someone take over an active agent session instead of starting their own.

What you can do

• →Restrict file permissions on Claude Code and Codex session-storage directories so only the owning user can read them.
• →Review any process that combines a transcript-store path with a search tool (grep/rg/jq/awk/sed) or a --resume/--continue flag, and confirm it was run by the legitimate user for a legitimate reason.
• →Avoid storing secrets or sensitive data in agent conversations that get persisted to disk.
• →Treat this signal as a starting point, not proof of compromise — correlate it with other activity before taking action, since developers legitimately grep their own transcripts.

Known benign look-alikes

• A developer debugging their own agent by grepping their own transcripts, e.g. `rg "timeout" ~/.claude/projects` -- indistinguishable from reconnaissance at the process-exec layer; this is the primary reason the rule is report-only.
• Support/diagnostic scripts that jq over ~/.claude.json for non-config fields not covered by filter_config_debug.
• Homegrown session-analytics or token-accounting scripts that awk/sed over ~/.codex/sessions rollout files.
• A user legitimately resuming their own session (`claude --resume`) from inside a shell whose command line also happens to reference the projects directory.
• Installing, inspecting or reading the help output of agsearch (suppressed by filter_package_ops / filter_help).
• Backup, archive or cleanup jobs that touch the session directories (suppressed by filter_backup_or_cleanup).
• A repository whose own source tree contains a file or binary literally named `agsearch` being executed during a build.

References

• https://owasp.org/Top10/A04_2021-Insecure_Design/
• https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures/
• https://docs.anthropic.com/en/docs/claude-code