Researchers Show How Tampered Conversation Histories Can Hijack AI Coding Agents
Summary
Darktrace researchers found that several AI agent harnesses trust locally stored conversation histories without validating them. By fabricating prior messages, they induced agents in tests to perform offensive actions, including a sandboxed domain compromise.
Key points
- Claude Code, AWS Kiro-CLI, OpenAI Codex, and the open-source Pi store conversation history locally without verifying that model responses are authentic or unaltered.
- Researchers modified stored histories to make agents believe they had been authorized to conduct red-team engagements.
- In sandbox tests, agents were induced to compromise an Active Directory environment or, in a separate test, exfiltrate sensitive information by email.
- Guardrail responses varied: some models blocked certain offensive requests, but fabricated context influenced agents that proceeded.
- A malicious package or MCP server could potentially alter an agent's local history and orchestrate attacks using the harness's tools and network access.
- Darktrace recommends cryptographically signing model responses and verifying them server-side; it also identifies behavioral monitoring as a defensive layer.
Article Details
- Attack Vectors
- An attacker who can modify locally stored conversation history can insert fabricated agent responses and prior exchanges. The tested harnesses accepted that history without validating that the model produced it.
- In sandbox tests, fabricated histories portraying prior authorized red-team work led agents using Kiro-CLI and Claude Code to conduct offensive activity that resulted in full Active Directory compromise. Model guardrails prevented some other tested attempts.
- In a separate test, a Codex agent using GPT 5.6 Sol was convinced to exfiltrate sensitive information over email.
- The article proposes, but does not report observing, a malicious software package such as a planted MCP server injecting history into a developer’s local harness database and orchestrating an agent-driven attack.
- Defensive Notes
- Darktrace recommends that harness providers cryptographically sign model responses and verify historical messages server-side; defenders cannot deploy this provider-side change themselves.
- Monitor agent behavior for deviations from its normal activity. Darktrace says Darktrace / SECURE AI provides visibility into prompts, sessions, model activity, and outputs.
MITRE ATT&CK
T1046 · Network Service DiscoveryIn the sandboxed agent-hijack experiment, the agent was induced to run scans as part of its offensive activity.T1048 · Exfiltration Over Alternative ProtocolIn a test using GPT 5.6 Sol, a Codex agent was convinced to exfiltrate sensitive information over email.T1565.001 · Stored Data ManipulationResearchers overwrote an agent response in Kiro-CLI’s locally stored SQLite conversation history with an UPDATE statement; the harness accepted the altered record.
Vendors
Anthropicnote: The work described in this article involves leveraging a design choice consistent across all of Anthropic’s Claude Code, OpenAI’s Codex, and AWS’s Kiro-CLI. On 18th August 2026, Darktrace disclosed our findingsAWSinvolves leveraging a design choice consistent across all of Anthropic’s Claude Code, OpenAI’s Codex, and AWS’s Kiro-CLI. On 18th August 2026, Darktrace disclosed our findings responsibly to these three organizations,Darktraceacross all of Anthropic’s Claude Code, OpenAI’s Codex, and AWS’s Kiro-CLI. On 18th August 2026, Darktrace disclosed our findings responsibly to these three organizations, and after a period of 30 days we nowOpenAIin this article involves leveraging a design choice consistent across all of Anthropic’s Claude Code, OpenAI’s Codex, and AWS’s Kiro-CLI. On 18th August 2026, Darktrace disclosed our findings responsibly to these
Products
Amazon BedrockAWS Kiro subscription, or in the case of Claude Code and OpenAI Codex, using models hosted in Amazon Bedrock. In each case, we modified locally stored history to show a lengthy conversation in which the agentClaude Codedescribed in this article involves leveraging a design choice consistent across all of Anthropic’s Claude Code, OpenAI’s Codex, and AWS’s Kiro-CLI. On 18th August 2026, Darktrace disclosed our findings responsiblyClaude Opus 4.6For AWS Kiro-CLI, the agent was convinced to hack a sandboxed lab environment with a combination of Claude Opus 4.6 and Claude Sonnet 4.5. Ultimately, the full AD was compromised.Claude Sonnet 4.5For AWS Kiro-CLI, the agent was convinced to hack a sandboxed lab environment with a combination of Claude Opus 4.6 and Claude Sonnet 4.5. Ultimately, the full AD was compromised.Codexarticle involves leveraging a design choice consistent across all of Anthropic’s Claude Code, OpenAI’s Codex, and AWS’s Kiro-CLI. On 18th August 2026, Darktrace disclosed our findings responsibly to these threeDarktrace / SECURE AIDarktrace / SECURE AI is our answer to this problem. By ensuring extensive visibility over AI prompts, model thought processes, and determined outputs, Darktrace can identify anomalous or potentially malicious behaviorsGPT 5.6 Lunato convince a codex agent to hack in our lab environment, guardrails were triggered for all of GPT 5.6 Luna, Terra, and Sol.GPT 5.6 SolFor OpenAI Codex, the agent was convinced to exfiltrate sensitive information over email using GPT 5.6 Sol. While we attempted to convince a codex agent to hack in our lab environment, guardrails were triggered for allGPT 5.6 TerraKiro-CLIleveraging a design choice consistent across all of Anthropic’s Claude Code, OpenAI’s Codex, and AWS’s Kiro-CLI. On 18th August 2026, Darktrace disclosed our findings responsibly to these three organizations, andOpus 5using Sonnet 5, again resulting in a full AD compromise. Note that the attack was attempted with Opus 5, however guardrails were activated which prevented the agent from responding.Pithat this design choice holds across Anthropic Claude Code, AWS Kiro-CLI, OpenAI Codex, and the open-source Pi.Sonnet 5For Anthropic Claude Code, the agent was convinced to hack the same sandboxed lab environment using Sonnet 5, again resulting in a full AD compromise. Note that the attack was attempted with Opus 5, however guardrails