Reconstructing AI Agent Activity: Two New Scripts for Forensic Review, (Thu, Oct 8th)

Two Python scripts, opencode-chat-replay.py and hermes_forensic_extract.py, have been developed to facilitate forensic review of AI coding assistants OpenCode and Hermes. The opencode script reconstructs chat transcripts from SQLite databases, supporting multiple storage formats and exporting in Markdown, JSON, or JSONL formats. The Hermes script extracts a broader set of forensic artifacts including session data, API request dumps, and application logs, outputting newline-delimited JSON records. Both scripts operate on local copies of evidence and do not modify original data. They support filtering by time range, session ID, and source files to narrow investigations. These tools assist incident responders in understanding user interactions with AI assistants by exposing detailed session metadata, conversation content, tool calls, errors, and usage metrics.

These scripts provide forensic investigators with enhanced visibility into AI agent usage on compromised or investigated systems. They enable reconstruction of user queries, AI responses, tool invocations, and associated metadata, which can be critical for understanding the role of AI assistants in security incidents. The tools themselves do not introduce vulnerabilities or exploits but improve incident response capabilities by making AI activity auditable and transparent.

No remediation or patching is required as these are forensic analysis tools, not vulnerabilities or exploits. Organizations should consider integrating these scripts into their incident response workflows to improve investigation of AI agent usage. Use of these tools requires access to local system data or forensic images containing AI assistant artifacts.