SANS Releases New Forensic Scripts to Reconstruct AI Coding Assistant Activity
What Happened – The SANS Internet Storm Center published an update to its FOR577 training material, adding two open‑source scripts that automate the collection and analysis of artefacts left by popular AI coding assistants (Claude Code, Codex, Gemini CLI, Cursor, Copilot, Warp, Windsurf, Qwen Code, etc.). The scripts help incident responders locate chat histories, prompt logs, and configuration files that may be relevant to a breach investigation.
Why It Matters for Trust & Control Assurance
- Demonstrates the need for a control objective that ensures AI system usage is continuously monitored and auditable – a prerequisite for proving compliance with AI‑risk frameworks.
- Provides concrete evidence‑collection methods that can be fed into a continuous control‑assurance program, creating a defensible audit trail of AI‑generated code and interactions.
- Highlights a gap many organizations have: lacking tooling to surface AI‑assistant artefacts, which can hide malicious code injection or data exfiltration.
Who Is Affected – Technology and SaaS providers, development teams, and any organization that integrates AI coding assistants into their software‑development lifecycle.
Recommended Actions
- Incorporate the new scripts into your incident‑response playbooks and map the artefacts they collect to the AI‑governance control area (e.g., “monitor and log AI model usage”).
- Validate that your logging and monitoring controls capture the same data points the scripts surface, ensuring continuous evidence for audits.
- Conduct a gap analysis against your AI‑risk framework (NIST AI RMF, ISO/IEC 42001) to confirm coverage.
Technical Notes – The scripts target local file systems, user profile directories, and cloud‑sync locations where AI assistants store prompts, responses, and configuration metadata. No CVE or vulnerability is disclosed; the focus is on forensic data‑source identification.