Reconstructing AI Agent Activity: Two New Scripts for Forensic Review, (Thu, Oct 8th)
SANS published two Python scripts that reconstruct OpenCode and Hermes AI agent activity for forensic review.
A SANS Internet Storm Center diary introduces two Python scripts for reconstructing activity from AI coding agents during incident response. opencode-chat-replay.py turns OpenCode’s SQLite session store, by default ~/.local/share/opencode/opencode.db, into Markdown, JSON, or JSONL transcripts including tool calls and token data. hermes_forensic_extract.py pulls Hermes conversation records, model usage, API request dumps, and application logs. Both support time filters, copy database sidecars before read-only access, and are intended for forensic review rather than replaying agent actions.
44