SpecterOps has released Blacklight, an open-source toolkit that identifies local artifacts from AI coding agents like Codex, Claude Code, Cursor, and Antigravity CLI, which can expose authentication data, session history, project details, and connected services.

AI agents are increasingly used to write code, troubleshoot problems, run commands, inspect repositories, and interact with cloud resources.

These tools improve productivity, but they also create a new endpoint security concern. Their local files may contain sensitive information that attackers could use after gaining access to a workstation.

Blacklight helps authorized security teams understand this emerging exposure. Rather than immediately collecting every file, the toolkit first identifies installed AI agents.

It ranks the most useful artifacts for review. This approach is intended to reduce unnecessary data collection and help defenders understand what needs protection.

Blacklight Toolkit

The most sensitive artifacts are authentication files. Codex files such as .codex/auth.json and Claude Code credential files may contain access tokens, refresh tokens, account identifiers, session metadata, and OAuth-related information.

A valid access token could allow an attacker to impersonate an authenticated user session. Refresh tokens may also provide longer-term access if they remain valid.

Decoded access token revealing authentication mechanism and email (source : specterops ) — Decoded access token revealing authentication mechanism and email (source: Specterops )

Configuration files can reveal another layer of risk. Settings may show which models a user runs, trusted projects, command approval settings, sandbox rules, environment variables, and MCP server configurations.

In some cases, environment variables may include API keys, cloud credentials, or connection information for external model providers. This information can help an attacker identify trusted services and possible paths into other systems.

Session transcripts are also valuable. AI agent chat history can reveal what a user is working on, internal file paths, repository names, debugging output, deployment instructions, internal URLs, hostnames, and commands.

Even when sessions do not contain raw credentials, they can reveal business context and operational intent. An attacker could use that information to identify important infrastructure, active projects, or possible follow-on targets.

Blacklight Scout provides endpoint discovery across Windows, macOS, and Linux. Its quieter loaders perform filesystem triage and report discovered agent roots, valuable paths, file size, and recency without reading artifact contents.

Blacklight session analysis report artifacts (source : specterops ) — Blacklight session analysis report artifacts (source: SpecterOps)

Windows executables can perform deeper metadata analysis, but they are designed not to print secrets, identities, session text, or endpoints.

For deeper investigation, selected files can be collected and processed offline with the blacklight sessions command. The analysis can identify supported agent files, parse recognizable formats, generate redacted indicators, and create ranked reports.

The toolkit can also prepare artifacts for tools such as Nemesis and TruffleHog, which can perform more extensive secret scanning. For defenders, Blacklight includes osquery configurations and SIEM guidance for inventorying agent artifacts and monitoring changes.

On Windows, the project recommends Security Event 4663 with Audit File System enabled and appropriate SACLs applied to high-value paths.

On macOS and Linux, defenders can use file event telemetry. However, monitoring must be carefully tuned, as it can generate significant volume.

The SpecterOps research highlights a growing reality for enterprise security teams: local AI agents should be treated like browser profiles, cloud CLI configurations, shell history, and other valuable endpoint data stores.

Organizations should inventory AI agent use, restrict access to local profile directories, monitor reads of credential files, review trusted-project settings, and establish retention policies for sessions. As developers rely more heavily on AI agents, protecting their local artifacts will become an important part of endpoint defense.

Strengthen Your SOC by Accelerating Threat Detection & Rapid Investigations. -> Integrate ANY.RUN With Your SOC Now.

The post Blacklight Toolkit Finds Codex, Claude Code, and Cursor Artifacts Exposing Tokens and Session Data appeared first on Cyber Security News.