Blacklight Toolkit Exposes Tokens, Session Data in Codex, Claude, Cursor Artifacts

Key Takeaways

• SpecterOps has released Blacklight, an open-source toolkit designed to identify sensitive data artifacts left by AI coding agents.
• The toolkit reveals that AI agents like Codex, Claude Code, and Cursor can store authentication tokens, session histories, project details, and connected service information locally.
• These artifacts, if compromised, could allow attackers to impersonate users, gain access to linked systems, or gather intelligence on ongoing projects.
• Blacklight assists security teams in discovering these exposures across Windows, macOS, and Linux, enabling targeted data collection and mitigation strategies.
• Organizations are urged to inventory AI agent usage, secure local profile directories, and monitor access to credential files to reduce risk.

A new open-source toolkit named Blacklight, developed by SpecterOps, has brought to light a significant vulnerability: AI coding agents such as Codex, Claude Code, Cursor, and Antigravity CLI are leaving behind local artifacts that can expose critical authentication data, session histories, project specifics, and details of connected services. This revelation underscores a growing concern for endpoint security in an era increasingly reliant on AI-driven development tools.

The proliferation of AI agents in software development has dramatically enhanced productivity, enabling developers to streamline code generation, troubleshoot issues, execute commands, analyze repositories, and interact with cloud resources more efficiently. However, this convenience introduces a new attack surface. Local files generated by these AI tools can contain highly sensitive information, presenting a lucrative target for adversaries who manage to gain access to a developer’s workstation.

Blacklight aims to equip authorized security teams with the means to understand and address this emerging threat landscape. Instead of indiscriminately collecting all files, the toolkit intelligently first identifies installed AI agents. It then prioritizes the most valuable artifacts for review, a method designed to minimize unnecessary data collection and help defenders focus their protective efforts where they are most needed.

Blacklight Toolkit Capabilities

Authentication and Configuration Risks

Among the most critical artifacts identified are authentication files. For instance, Codex files like .codex/auth.json and Claude Code credential files frequently contain access tokens, refresh tokens, account identifiers, session metadata, and OAuth-related information. A compromised, valid access token could enable an attacker to hijack an authenticated user session, while refresh tokens might offer persistent access if they remain active for extended periods.

Beyond authentication, configuration files present another layer of risk. These settings can disclose details about the AI models a user operates, trusted projects, command approval parameters, sandbox rules, environment variables, and MCP server configurations. Crucially, environment variables sometimes embed API keys, cloud credentials, or connection details for external model providers. Such information could empower an attacker to map trusted services and pinpoint potential entry points into other interconnected systems.

Session Transcripts and Operational Intelligence

Session transcripts, or chat histories generated by AI agents, are equally valuable to an adversary. These logs can reveal a user’s current work, internal file paths, repository names, debugging output, deployment instructions, internal URLs, hostnames, and executed commands. Even in the absence of raw credentials, these transcripts offer crucial business context and operational intent. An attacker could leverage this intelligence to identify critical infrastructure, active development projects, or potential follow-on targets for further exploitation.

Blacklight Scout for Discovery and Analysis

The Blacklight toolkit includes Blacklight Scout, which facilitates endpoint discovery across Windows, macOS, and Linux systems. Its discreet loaders perform filesystem triage, reporting discovered AI agent root directories, significant paths, file sizes, and recency without accessing the actual contents of the artifacts. While Windows executables can conduct more in-depth metadata analysis, they are specifically designed to avoid printing secrets, identities, session text, or endpoint details.

For more comprehensive investigations, selected files can be collected and processed offline using the blacklight sessions command. This analysis can pinpoint supported agent files, parse recognized formats, generate redacted indicators, and produce prioritized reports. Furthermore, the toolkit can prepare artifacts for integration with other security tools like Nemesis and TruffleHog, which specialize in extensive secret scanning. For defensive measures, Blacklight offers osquery configurations and SIEM guidance to help inventory agent artifacts and monitor for changes.

On Windows, SpecterOps recommends enabling Security Event 4663 with Audit File System and applying appropriate System Access Control Lists (SACLs) to high-value paths. For macOS and Linux environments, file event telemetry can be employed, though careful tuning is necessary to manage the potentially high volume of generated data.

The SpecterOps research highlights a crucial paradigm shift for enterprise security teams: local AI agents must now be treated with the same level of scrutiny as browser profiles, cloud CLI configurations, and shell histories. As developers increasingly depend on AI agents, safeguarding their local artifacts will become an indispensable component of robust endpoint defense strategies.

What You Should Do

• Inventory AI Agent Usage: Conduct a thorough inventory of all AI coding agents deployed across your organization’s endpoints to understand the scope of potential exposure.
• Restrict Access: Implement strict access controls to local profile directories where AI agent artifacts are stored. Ensure only authorized users and processes can access these sensitive locations.
• Monitor Credential File Access: Establish monitoring rules to detect and alert on unauthorized or suspicious reads of AI agent credential files.
• Review Trusted Project Settings: Regularly audit and review the “trusted project” settings within AI agents to ensure they align with organizational security policies and do not grant excessive permissions.
• Implement Data Retention Policies: Define and enforce clear data retention policies for AI agent sessions and artifacts, ensuring sensitive data is not stored longer than necessary.
• Utilize Blacklight: Deploy the Blacklight toolkit to proactively identify and manage AI agent-related risks across your Windows, macOS, and Linux environments.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.