SpecterOps has introduced Blacklight, an open-source toolkit designed to identify local artifacts from AI coding agents such as Codex, Claude Code, Cursor, and Antigravity CLI. These artifacts can inadvertently expose sensitive information, including authentication data, session histories, project details, and connected services.
AI coding agents have become integral tools for developers, assisting in code writing, problem-solving, command execution, repository inspection, and cloud resource interaction. While they enhance productivity, they also introduce new endpoint security challenges. The local files generated by these agents may contain sensitive data that, if accessed by unauthorized individuals, could lead to security breaches.
Blacklight addresses this emerging risk by enabling security teams to identify and assess these artifacts. Instead of indiscriminately collecting all files, the toolkit first detects installed AI agents and prioritizes the most critical artifacts for review. This targeted approach minimizes unnecessary data collection and helps defenders focus on protecting the most vulnerable information.
Key Features of Blacklight
One of the primary concerns is the exposure of authentication files. For instance, Codex stores credentials in files like .codex/auth.json, while Claude Code has its own credential files. These may contain access tokens, refresh tokens, account identifiers, session metadata, and OAuth-related information. If an attacker gains access to a valid access token, they could impersonate an authenticated user session. Refresh tokens pose an even greater risk, potentially providing prolonged access if they remain valid.
Configuration files present another layer of vulnerability. They can reveal details about the models a user operates, trusted projects, command approval settings, sandbox rules, environment variables, and MCP server configurations. Notably, environment variables might include API keys, cloud credentials, or connection information for external model providers. Such information can guide attackers toward trusted services and potential entry points into other systems.
Session transcripts are also of significant value. The chat histories of AI agents can disclose user activities, internal file paths, repository names, debugging outputs, deployment instructions, internal URLs, hostnames, and executed commands. Even if these sessions don’t contain explicit credentials, they can provide insights into business operations and intentions, aiding attackers in identifying critical infrastructure, ongoing projects, or subsequent targets.
Blacklight’s Functionality
Blacklight Scout offers endpoint discovery capabilities across Windows, macOS, and Linux platforms. Its efficient loaders perform filesystem triage, reporting discovered agent roots, valuable paths, file sizes, and recency without reading the contents of the artifacts. While Windows executables can conduct deeper metadata analysis, they are designed to avoid displaying sensitive information such as secrets, identities, session texts, or endpoints.
For more in-depth investigations, selected files can be collected and analyzed offline using the blacklight sessions command. This analysis identifies supported agent files, parses recognizable formats, generates redacted indicators, and creates prioritized reports. Additionally, the toolkit can prepare artifacts for further examination with tools like Nemesis and TruffleHog, which specialize in extensive secret scanning.
To assist defenders, Blacklight provides osquery configurations and Security Information and Event Management (SIEM) guidance for inventorying agent artifacts and monitoring changes. On Windows systems, it recommends enabling Security Event 4663 with Audit File System and applying appropriate System Access Control Lists (SACLs) to high-value paths. For macOS and Linux, file event telemetry can be utilized, though monitoring must be carefully tuned to manage the potential volume of data.
The research underscores a growing concern for enterprise security teams: local AI agents should be treated with the same caution as browser profiles, cloud CLI configurations, shell histories, and other sensitive endpoint data stores. Organizations are advised to inventory AI agent usage, restrict access to local profile directories, monitor credential file access, review trusted-project settings, and establish retention policies for session data.
As developers increasingly rely on AI agents, safeguarding their associated artifacts becomes paramount. Blacklight offers a proactive solution to identify and mitigate these risks, ensuring that the benefits of AI coding agents do not come at the expense of security.
