# Agent Session Store Content Search and Resumption

- **Severity:** Medium
- **Signature ID:** `7c3f9e21-4b6d-4a58-9f2e-1d8c05b7a643`

## Summary

Claude Code and Codex CLI save every conversation to disk. This rule flags command lines that search those saved conversations for content, or that reopen (resume) a past session — behavior that could mean someone is digging through old chats for secrets or hijacking an in-flight session.

## How the attack works

Attackers (or an AI agent tricked by a malicious instruction embedded in its input) look for text-search or file-processing tools run against the folders where Claude Code or Codex store conversation history, such as ~/.claude/projects, ~/.claude/history, ~/.codex/sessions, or ~/.claude.json. This can take two forms: running a purpose-built tool like agsearch that indexes and searches past sessions by content, or combining a transcript-store path with a generic tool like grep, rg, jq, or a resume/continue flag on the same command line. Either pattern lets someone pull sensitive information out of past agent conversations, or pick up and continue a session that isn't theirs.

## Why it matters

If successful, this exposes whatever was discussed or shared in prior agent sessions — which can include credentials, internal data, or proprietary code — and can let someone take over an active agent session instead of starting their own.

## What you can do

- Restrict file permissions on Claude Code and Codex session-storage directories so only the owning user can read them.
- Review any process that combines a transcript-store path with a search tool (grep/rg/jq/awk/sed) or a --resume/--continue flag, and confirm it was run by the legitimate user for a legitimate reason.
- Avoid storing secrets or sensitive data in agent conversations that get persisted to disk.
- Treat this signal as a starting point, not proof of compromise — correlate it with other activity before taking action, since developers legitimately grep their own transcripts.

## Known benign look-alikes

- A developer debugging their own agent by grepping their own transcripts, e.g. `rg "timeout" ~/.claude/projects` -- indistinguishable from reconnaissance at the process-exec layer; this is the primary reason the rule is report-only.
- Support/diagnostic scripts that jq over ~/.claude.json for non-config fields not covered by filter_config_debug.
- Homegrown session-analytics or token-accounting scripts that awk/sed over ~/.codex/sessions rollout files.
- A user legitimately resuming their own session (`claude --resume`) from inside a shell whose command line also happens to reference the projects directory.
- Installing, inspecting or reading the help output of agsearch (suppressed by filter_package_ops / filter_help).
- Backup, archive or cleanup jobs that touch the session directories (suppressed by filter_backup_or_cleanup).
- A repository whose own source tree contains a file or binary literally named `agsearch` being executed during a build.

## References

- https://owasp.org/Top10/A04_2021-Insecure_Design/
- https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures/
- https://docs.anthropic.com/en/docs/claude-code

---
Source: https://www.netzilo.com/threats/session-search-resumption