Nobody attacks anything. Every step is allowed. That is why nothing else flags it.
An agent reads something private to do a job it was asked to do. A later session finds it and sends it somewhere open. Sixty seconds each, no sound needed. AgentSaw is the only thing in the room that connects the two.
Customer records into public API docs, and an unannounced launch name into an outside email. Different agents, different destinations, the same handoff underneath.
No exploit, no jailbreak, no rogue tool, just ordinary agent actions, across two sessions and two agents, three days apart.
A shared rule that every agent on the team follows (Cursor, Claude Code, Codex), copied months ago from a popular best-practices template: "save the values you use to a notes file, so the next session doesn't have to look them up again." It sounds helpful. It's the setup.
"The app won't connect, get it running." To debug, the agent reads your project config, like it does in every repo. It now holds your live database password and cloud keys. Nobody asked it to collect anything; it's just doing the job.
Following that rule, it saves the values it just used into its notes. No instruction ever said steal this. It said remember it.
"Add logging so we can debug the staging connection." The connection fails, and the log line prints the full connection string, password and all, into the test logs. Standard debugging.
"Write the new-engineer setup guide from our notes." A different session, a different agent. A setup guide is supposed to show how to connect, so the agent fills in the real values instead of placeholders and publishes it to the internal wiki. No repo, no commit, nothing for code scanners to catch.
The moment a session reads a secret, AgentSaw marks it as a real credential and follows it through the notes file, the logs, wherever it goes. When another session, or a different agent, later writes that same secret toward the wiki, AgentSaw recognizes it and raises a critical alert before the page publishes. It follows the key itself, across every session and agent.
We will install it on one machine and show you what has been moving between your own sessions. If the answer is nothing, that is a good afternoon for both of us. Nobody pays anybody, and we ask for one thing back: tell us honestly what you think.