Nobody attacks anything. Every step is allowed. That is why nothing else stops it.
An agent reads something private to do a job it was asked to do. A later session, often a different agent, finds it and tries to send it out. Start with the full story, narrated. The three short films under it show the same shape with different data, sixty seconds each, no sound needed.
Captions on screen; turn the sound on for the narration. A reconstruction of real, observed agent behaviour; the key is made up.
A live cloud key into an internal wiki, customer records into public API docs, and an unannounced launch name into an outside email. Different agents, different destinations, the same handoff underneath.
No exploit, no jailbreak, no rogue tool, just ordinary agent actions, across two sessions and two agents, three days apart.
A shared rule that every agent on the team follows (Cursor, Claude Code, Codex), copied months ago from a popular best-practices template: "save the values you use to a notes file, so the next session doesn't have to look them up again." It sounds helpful. It's the setup.
"The app won't connect, get it running." To debug, the agent reads your project config, like it does in every repo. It now holds your live database password and cloud keys. Nobody asked it to collect anything; it's just doing the job.
Following that rule, it saves the values it just used into its notes. No instruction ever said steal this. It said remember it.
"Add logging so we can debug the staging connection." The connection fails, and the log line prints the full connection string, password and all, into the test logs. Standard debugging.
"Write the new-engineer setup guide from our notes." A different session, a different agent. A setup guide is supposed to show how to connect, so the agent fills in the real values instead of placeholders and publishes it to the internal wiki. No repo, no commit, nothing for code scanners to catch.
The moment a session reads a secret, AgentSaw marks it as a real credential and follows it through the notes file, the logs, wherever it goes. When another session, or a different agent, later writes that same secret toward the wiki, AgentSaw recognizes it and stops the write before the page publishes, with both sessions on one alert. It follows the key itself, across every session and agent.
Tell us a little about your team and we will get back to you to set up a time. In 20 minutes we install it on one machine, and you try to get a key out through your own agents. Nothing to buy.
Prefer email? tamir@agentsaw.com