AI agent forensics: where conversation history lives in OpenCode and Hermes

What happened and what to do

The SANS ISC post describes the author's search for conversation history evidence in OpenCode and Hermes, to support forensic investigations of AI assistant use. According to the text, the fifth day of the FOR577 course was substantially updated to cover AI use in incident response, discussing eight popular coding assistants and agents: Claude Code, Codex, Gemini CLI, Cursor, Copilot, Warp, Windsurf and Qwen Code. The author uses Claude Code and some Codex, and was trying OpenCode and setting up Hermes.

For a company, the case shows that coding agent sessions can leave local records on workstations, and that these records differ from tool to tool. A practical response is to map, for each tool the team uses, where its history is stored, which fields it holds and how long it stays available, and record that inventory in an incident response runbook. It is also possible to build a controlled collection pipeline, with restricted access and chain of custody, that preserves these artifacts when an incident requires it, rather than relying on each user's memory.

How the consultancy can help

Diagnosis of your organization's exposure to AI assistant and agent use, including an inventory of tools, of where history is kept on workstations and servers, and of retention gaps. Then design and implementation of a forensic runbook and a controlled collection process, operated within your environment.

Next step

If your team uses coding assistants and AI agents and you want to know what can be recovered in an investigation, send a short description of your case, with the tools in use and the incident context. Based on it, Wendelmaques prepares a scoped proposal for diagnosis and implementation.