AgentSaw is cross-session security for AI coding agents. Here's the leak it's built to catch.
One coding session reads one of your secrets. A later session, days apart, sometimes a different agent entirely, writes it into a public doc. Each step is in policy, so your scanners, DLP and EDR see nothing. AgentSaw follows the value across sessions and agents, and catches the leak none of them can connect.
Each one: a value read by one AI coding agent, found and shipped out by another in a later session, and the AgentSaw timeline and alert that connect them. The story's on screen, no sound needed.
Tip: scrub anywhere on the timeline to re-read a step — ← / → skip 5s, and the 1× button slows playback down for reading.
No exploit, no jailbreak, no rogue tool, just ordinary agent actions, across two sessions and two agents, three days apart.
A shared rule that every agent on the team follows (Cursor, Claude Code, Codex), copied months ago from a popular best-practices template: "save the values you use to a notes file, so the next session doesn't have to look them up again." It sounds helpful. It's the setup.
"The app won't connect, get it running." To debug, the agent reads your project config, like it does in every repo. It now holds your live database password and cloud keys. Nobody asked it to collect anything; it's just doing the job.
Following that rule, it saves the values it just used into its notes. No instruction ever said steal this. It said remember it.
"Add logging so we can debug the staging connection." The connection fails, and the log line prints the full connection string, password and all, into the test logs. Standard debugging.
"Write the new-engineer setup guide from our notes." A different session, a different agent. A setup guide is supposed to show how to connect, so the agent fills in the real values instead of placeholders and publishes it to the internal wiki. No repo, no commit, nothing for code scanners to catch.
Your device tools watch the device. Your AI tools watch the prompt. Your data tools watch what leaves as a file. Each step was in policy on its own. The leak only shows up when you connect all of them.
The moment a session reads a secret, AgentSaw marks it as a real credential and follows it through the notes file, the logs, wherever it goes. When another session, or a different agent, later writes that same secret toward the wiki, AgentSaw recognizes it and raises a critical alert before the page publishes. It follows the value itself, across every session and agent.
And it was never just one secret. That notes file, re-read every session, has quietly collected the rest of your secrets over weeks.
We're working with a small group of teams that lean on AI coding agents every day, to catch these leaks before they ship. If that's you, let's talk.