Reconstructing AI agent activity: two new scripts for forensic analysis

According to the publication, a major update to course FOR577 added new material on day five about investigating AI use in incident response. The material covers eight popular AI coding assistants and agents: Claude Code, Codex, Gemini CLI, Cursor, Copilot, Warp, Windsurf and Qwen Code. The author says he uses Claude Code and, to a lesser extent, Codex, and is experimenting with OpenCode while setting up Hermes. He set out to find where conversation history is kept in OpenCode and where evidence from Hermes might be located. The text states the focus of the search but does not detail file paths, formats or results; those points should be checked in the original. Relevance: the case shows that AI tools on workstations may keep interaction records that matter to incident response teams. This item concerns device forensics, which is not a capability of Rota Nacional. Rota does not collect or analyze the local history of these tools. To consult the source, open the SANS ISC feed through the origin channel named in the text and check the date and full content of the diary entry.