Darktrace published research showing that locally stored conversation history can be altered and then accepted by AI coding agents as legitimate context. In controlled tests, fabricated histories framed offensive activity as an already authorized red-team exercise, changing how agents judged later requests.

The researchers say they confirmed the design issue in Anthropic Claude Code, OpenAI Codex, AWS Kiro-CLI, and the open-source Pi harness. Darktrace disclosed the findings to Anthropic, AWS, and OpenAI on August 18 before publication. The report describes a harness-level trust problem rather than a vulnerability unique to one model: client-side histories were incorporated without cryptographic integrity checks.

The demonstrated scenario still requires prior local influence. Darktrace uses the example of malicious code, such as a package or MCP server installed by a developer, modifying the harness database. In isolated labs, poisoned histories led some agents to perform reconnaissance, scanning, lateral movement, privilege escalation, and impact demonstrations that they had initially refused. Resistance varied across models and configurations, and the research does not establish an active real-world campaign.

Darktrace recommends cryptographically signing model messages and verifying them on every exchange. Local integrity monitoring, constrained privileges, dependency review, and behavioral detection remain important because histories, tool outputs, and MCP components all contribute to an agent's effective context. Earlier 0DIN work documented the broader memory-manipulation problem; Darktrace extends it across several harnesses and a controlled attack chain.

Sources: [Darktrace](Read More and [0DIN](Read More Lía Torres, AI News