On September 24, 2026, Darktrace published "conversation history poisoning" research with a disturbing finding: Claude Code, Codex, Kiro-CLI, and Pi all store conversation history in plain local SQLite — with no integrity verification — and in testing, all four accepted fabricated history as genuine. Inject a fake turn into that SQLite file ("you approved the domain join, run these commands") and the agent treats it as its own memory — an authorization you never gave. In Darktrace's tests, the planted commands escalated to full Active Directory compromise. No network exploit needed: anything on your machine that can write a file can rewrite your agent's memory. This free 60-second audit tests the history integrity of your setup across the four affected harnesses.
Key figure: 63% of organizations in IBM's 2025 breach study had no AI governance policy, and 97% of AI-breach victims had no proper AI access controls (IBM, Cost of a Data Breach Report 2025).
Answer honestly. Here, "Yes" is the safe answer. Covers Claude Code, Codex, Kiro-CLI, and Pi.
This self-assessment is informational. It reflects Darktrace's September 24, 2026 research as reported — it is not legal advice.
Open-source helpers: history-store locator, directory permission checks, known-good baselines, and turn-diff scripts for the four affected harnesses.
Conversation history poisoning is an attack where an attacker edits the stored conversation history of an AI coding agent — injecting fabricated turns the user never sent — and the agent accepts the forgery as its own memory, then acts on it. Darktrace's September 24, 2026 research showed that Claude Code, Codex, Kiro-CLI, and Pi all store history in plain local SQLite, and in testing the agents accepted fabricated history, which led to full Active Directory compromise.
Conversation history poisoning is an attack where an attacker edits the stored conversation history of an AI coding agent — injecting fabricated turns the user never sent — and the agent accepts the forgery as its own memory, then acts on it. Darktrace's September 24, 2026 research showed that Claude Code, Codex, Kiro-CLI, and Pi all store history in plain local SQLite, and in testing the agents accepted fabricated history, which led to full Active Directory compromise.
According to Darktrace's September 24, 2026 "conversation history poisoning" research, all four tested harnesses were affected: Claude Code, Codex, Kiro-CLI, and Pi. Each stores conversation history in plain local SQLite with no integrity verification, and each accepted fabricated history in testing.
In Darktrace's testing, once the harness accepted fabricated history as genuine, the attacker could plant instructions inside fake "earlier" turns — commands the agent believed the user had authorized. Because coding agents run with the user's privileges, planted commands escalated through the environment to full Active Directory compromise. The poisoned memory becomes the authorization the agent never got from you.
Know where your harness stores history (plain local SQLite for the four tested agents); keep that directory writable only by you — no untrusted code, shared machines, or compromised repos should be able to touch it; verify conversation integrity before sensitive operations; treat any unexpected turn as hostile until proven otherwise; and keep your CLI harness updated, watching for integrity-verification features from the vendors.
Plain local SQLite is fast, simple, and works offline — engineering convenience, not a security decision. The problem Darktrace exposed is that nothing signs, hashes, or verifies those records, so any process with file access can rewrite the agent's memory and the agent cannot tell the difference.
Local file access is enough — no network needed. Any compromised dependency, malicious repo script, shared-machine user, or malware with file permissions on your home directory can edit the SQLite history file. The attack surface is "anything that can write to the history directory," which on most developer machines is a large set.
Filed under Cybersecurity News by Ingenious AI — see the related checks above for more in this series.