The case
Darktrace has published a demo that breaks an assumption most of us take for granted.
Claude Code, Codex and Kiro-CLI store the conversation history on disk without checking that those responses actually came from the model (Source: darktrace.com).
The agent reads that history on startup and treats it as trusted context, and I already see gaps in this...
Picture a malicious package installed on a developer's machine, and that package writes a fake conversation into the history file where the user authorizes the agent to run network tests.
When the agent restarts, it reads that history, takes the role, and acts like a pentester with permission, sending traffic against the internal network.
No need to touch the system prompt or the model server. Writing to a local file that nobody signs or verifies is enough.
The pattern
OX Security analyzed 15,465 public MCP servers and found that 15.6% resolve outside the United States, with 19 in China and 18 in Russia (Source: unite.ai).
0.45% run on home networks, watch out. And there are abandoned domains still cited in active configurations.
MCP is the protocol an agent uses to connect to external tools.
If that server is abandoned or lives on a home network, the agent is calling a stranger... not sure how you see it
The common shape with the Darktrace case is the same, because the attack surface is no longer the agent's sandbox: it is everything the agent reads and connects to.
The other side
AI also shows up as the attacker's tool, and this week there are two clear examples.
Anthropic has reported that seven labs in China ran illicit distillation campaigns against Claude, and the Alibaba one reached almost 3 million exchanges per day from 3,500 fraudulent accounts (Source: anthropic.com).
Distilling means using a large model's responses to train a small one....but...the student model does not inherit the original's safeguards.
The second example is Bitget, an exchange, which confirmed the largest hack of 2026: $351.6 million across 19 transfers from hot and warm wallets (Sources: cryptoslate.com).
The attacker did not steal private keys... instead they compromised an internal approval system, possibly a third-party tool, to forge transactions.
The $464 million fund covers the total.
My reading
My reading is that the underlying problem is the same in all three cases.
We are taking the context an agent consumes as valid without signing or verifying it.
In my lab, a history file is just another file, so if the agent reads it as an instruction, then it is executable code and deserves the same treatment.
What worries me is not the specific Darktrace case, what worries me more is that the industry's natural response will be to patch those three CLIs and leave the pattern intact.
What to look at
- Sign the responses. Ask vendors for agent history to carry a verifiable server-side signature. If it does not, treat it as untrusted input.
- Audit your MCP. Review which MCP servers you have configured, who maintains them, and from which network they resolve. An abandoned domain in the config is an agent calling a stranger.
- Separate the history. Keep agent history out of reach of user packages. If a package can write there, it can speak for the model.
How I would test it in my lab
I would set up a clean virtual machine with Claude Code installed and a history file by hand.
I would write a fake conversation where I authorize the agent to run a scan against an IP on my own lab network.
I would start the agent and watch whether it runs the scan without asking.
If it does, I have confirmation that history is a real entry point and not a theoretical one.
No malicious package is needed for this test.
Editing the file by hand and seeing what happens is enough.
The conclusion I would draw is whether my trust policy on the agent is well placed or whether I am trusting a file anyone can write.
Let me tell you in advance that...this does not only happen with the harnesses mentioned
Closing
An agent that reads its own history without verifying it is an agent that accepts orders from anyone who can write to disk.
The lesson of the week is that the agent's context is attack surface, not just its sandbox.
Originally published at https://sammideblas.com/notas/history-poisoning-turns-coding-agents-into-attackers
Top comments (0)