Darktrace Shows AI Agent Memory Hijack Compromises AD

Darktrace researchers poisoned AI coding agents' local conversation history to trigger a full Active Directory compromise, exposing an unpatchable trust flaw.

Forkast News reports that Darktrace Senior Security Researcher Eric Rozon published research on September 24, 2026 detailing a technique he calls conversation history poisoning — modifying an AI agent's claimed conversation history for malicious purposes. The core finding: agentic harnesses store conversation history client-side, often in a plain SQLite database, with no mechanism to verify that stored responses were genuinely produced by the model. Because the harness trusts the local database as the source of truth, an attacker who injects data into it can rewrite the agent's past. The attack chain began with a single malicious package installation — a planted Model Context Protocol (MCP) server — after which the package injected fabricated history into the local harness database, and a simple agentic loop prompted the compromised agent to attack the network it sat on.

According to Forkast News, Darktrace tested the technique across four harnesses — Anthropic Claude Code, OpenAI Codex, AWS Kiro-CLI, and the open-source Pi — and all four accepted the fabricated history. The demonstration was concrete: a full Active Directory compromise using Claude Opus 4.6 and Claude Sonnet 4.5 within Kiro-CLI, and a similar compromise of Claude Code using Sonnet 5, though Opus 5's guardrails blocked the agent from responding. With Codex, researchers convinced the agent to exfiltrate sensitive information over email using GPT 5.6 Sol, while guardrails blocked network exploitation across all GPT 5.6 variants. Forkast notes that models varied in resistance to offensive cyber activity, but the underlying flaw in history management was universal — and Darktrace's performance claims are self-reported from its own research environment, not independently verified in production.

The most consequential aspect, per Forkast News, is that the vulnerability cannot be patched by the end-user: the flaw lies in the harness architecture itself, in how it stores and trusts local conversation history. The recommended mitigation is for model providers to cryptographically sign all messages returned to the harness and verify those signatures server-side on every round-trip — meaning the fix must come from Anthropic, OpenAI, AWS, and every other harness developer. Darktrace disclosed its findings to Anthropic, OpenAI, and AWS on August 18, 2026, then published after a 30-day window; open-source Pi was excluded because it has no way to validate model history on its own. The vulnerability class was already cited by 0DIN and Serhat Çiçek, but Forkast reports Darktrace's work is the first public demonstration across multiple major harnesses simultaneously.

The realization that AI agents introduce systemic risks enterprises cannot currently mitigate has triggered a funding wave in the security layer, according to Forkast News: AIR Security raised $50 million on September 1, 2026 for an AI agent firewall that vets agents' skills, tools, and MCP servers; HiddenLayer secured $100 million on September 2 for Agentic Runtime Security; and AIUC raised $40 million on September 15 for AI risk auditing and certification — $190 million combined, still a fraction of what enterprises spend deploying agents. Until cryptographic signing arrives, Forkast's recommended defense is extreme caution about packages installed on workstations with access to sensitive environments. Dataconomy's practitioner guidance points the same direction, urging that agents be grounded only in approved content and reviewed continuously — a governance posture that now looks less like hygiene and more like survival.