CERT Intrinsec maps where autonomous coding agents leave traces on disk

Aug 10, 2026 · Issue 2 · 1 source, 1 article

CERT Intrinsec has launched a forensic series on OpenCode and OpenAI Codex CLI, identifying where they write their state. The same session databases and token files can also be targets for credential collection (10 August).

Sources

• CERT Intrinsec maps where autonomous coding agents leave evidence on disk; the same session databases and token files an investigator needs are a credential-collection targetctipilot.ch · Aug 10, 2026

Machine-generated summary based on the titles and excerpts of the source articles. The facts come from the linked article.