Every AI coding tool your developers are using right now stores its memory on the local machine, often in a plain SQLite database. None of them verify that the stored responses actually came from the model. Darktrace just showed what happens when someone exploits that gap.
Eric Rozon, a Senior Security Researcher at Darktrace, published a report on September 24, 2026, detailing a technique he calls conversation history poisoning — the modification of an AI agent’s claimed conversation history for malicious purposes. The core finding: agentic harnesses store conversation history client-side without any mechanism to verify that stored AI responses were genuinely produced by the model. Because the harness trusts the local database as the source of truth, an attacker who can inject data into that database can rewrite the past.
If an agent believes it previously agreed to a set of instructions or observed a specific system state, it will proceed based on that fabricated reality. Darktrace tested this across four harnesses: Anthropic Claude Code, OpenAI Codex, AWS Kiro-CLI, and the open-source Pi. All four accepted the fabricated history. While the models varied in their resistance to offensive cyber activity — with some guardrails preventing engagement — the fundamental flaw in history management was universal.
The attack chain is efficient enough to be practical. It begins with a single malicious package installation — a planted Model Context Protocol (MCP) server, for example, since only developers with agentic harnesses would install one. Once on a workstation, the package injects fabricated conversation history directly into the local harness database. An orchestration process — a simple agentic loop — then prompts the compromised agent to attack the network it sits on.
In testing, Darktrace demonstrated that this process led to a full Active Directory compromise using Claude Opus 4.6 and Claude Sonnet 4.5 within the Kiro-CLI harness. Claude Code was similarly compromised using Sonnet 5, though Opus 5’s guardrails prevented the agent from responding. With Codex, researchers convinced the agent to exfiltrate sensitive information over email using GPT 5.6 Sol, though guardrails blocked the agent from performing network exploitation across all of GPT 5.6’s variants. A single package install on a workstation was sufficient to weaponize an AI coding workflow, turning the workstation into an autonomous attacker — with the cost of the agentic loop shouldered by the victim, since the harness itself is legitimately installed and paid for.
It is worth noting that these findings are based on Darktrace’s own testing, and the effectiveness of the attack varied depending on the specific model and its internal guardrails. All performance claims are self-reported from Darktrace’s research environment, not independently verified in production settings.
The Fix Is Not Yours to Deploy
The most consequential aspect of this vulnerability is that it cannot be patched by the end-user. The flaw lies in the architecture of the harness itself — the way it stores and trusts local conversation history. The recommended mitigation is for model providers to cryptographically sign all messages returned to the harness and verify those signatures server-side on every round-trip. Without this, there is no way for the harness to distinguish between a genuine model response and a malicious injection.
This leaves enterprise security teams in an uncomfortable position. They are deploying these agents to increase developer productivity, but they currently lack the ability to secure the underlying infrastructure against this specific class of attack. The fix must come from Anthropic, OpenAI, AWS, and the developers of every other agentic harness. Until it does, defenders are essentially waiting.
Rozon’s disclosure timeline underscores the gap. Darktrace disclosed its findings to Anthropic, OpenAI, and AWS on August 18, 2026. After a 30-day window, the research was published on September 24. Pi, being an open-source harness rather than a model provider, was not included in the disclosure — it has no way to validate model history on its own. The vulnerability class was already known in research circles, cited by both 0DIN and Serhat Çiçek, but Darktrace’s work is the first public demonstration of the attack across multiple major harnesses simultaneously.
The Security Funding Wave
The realization that AI agents introduce systemic risks that enterprises cannot currently mitigate has triggered a wave of investment in the security layer. AIR Security raised $50 million on September 1, 2026, to build an AI agent firewall that discovers agents running inside a company and continuously vets the skills, tools, and MCP servers they use. HiddenLayer secured $100 million in Series B funding on September 2 for its platform focused on Agentic Runtime Security. And AIUC raised $40 million in Series A funding on September 15 for AI risk auditing and certification.
These are significant numbers, and it is worth asking what they leave out. The funding is a response to a problem that is still evolving — each of these companies is building infrastructure for a threat landscape that has not fully formed. The $190 million combined is also a fraction of what enterprises are spending to deploy the agents themselves. The security layer is playing catch-up to the adoption curve.
What Darktrace’s research makes clear is that the current generation of AI agent tools was not designed with a zero-trust approach to local memory. The conversation history that agents treat as ground truth is stored in databases that any process on the machine can modify. Until providers implement cryptographic signing, the best defense is extreme caution regarding the packages and extensions installed on workstations that have access to sensitive environments — and an honest reckoning with the fact that the tools your developers are using every day have a trust model that does not survive contact with a motivated attacker.