{"id":232216,"date":"2026-07-31T10:00:00","date_gmt":"2026-07-31T10:00:00","guid":{"rendered":"https:\/\/www.intrinsec.com\/?p=232216"},"modified":"2026-07-29T09:25:44","modified_gmt":"2026-07-29T09:25:44","slug":"ai-agents-digital-forensics-openai-codex-artifacts","status":"publish","type":"post","link":"https:\/\/www.intrinsec.com\/en\/ai-agents-digital-forensics-openai-codex-artifacts\/","title":{"rendered":"AI Agents X Digital Forensics 02 \u2013 Codex"},"content":{"rendered":"<div data-elementor-type=\"wp-post\" data-elementor-id=\"232216\" class=\"elementor elementor-232216\" data-elementor-settings=\"{&quot;element_pack_global_tooltip_width&quot;:{&quot;unit&quot;:&quot;px&quot;,&quot;size&quot;:&quot;&quot;,&quot;sizes&quot;:[]},&quot;element_pack_global_tooltip_width_tablet&quot;:{&quot;unit&quot;:&quot;px&quot;,&quot;size&quot;:&quot;&quot;,&quot;sizes&quot;:[]},&quot;element_pack_global_tooltip_width_mobile&quot;:{&quot;unit&quot;:&quot;px&quot;,&quot;size&quot;:&quot;&quot;,&quot;sizes&quot;:[]},&quot;element_pack_global_tooltip_padding&quot;:{&quot;unit&quot;:&quot;px&quot;,&quot;top&quot;:&quot;&quot;,&quot;right&quot;:&quot;&quot;,&quot;bottom&quot;:&quot;&quot;,&quot;left&quot;:&quot;&quot;,&quot;isLinked&quot;:true},&quot;element_pack_global_tooltip_padding_tablet&quot;:{&quot;unit&quot;:&quot;px&quot;,&quot;top&quot;:&quot;&quot;,&quot;right&quot;:&quot;&quot;,&quot;bottom&quot;:&quot;&quot;,&quot;left&quot;:&quot;&quot;,&quot;isLinked&quot;:true},&quot;element_pack_global_tooltip_padding_mobile&quot;:{&quot;unit&quot;:&quot;px&quot;,&quot;top&quot;:&quot;&quot;,&quot;right&quot;:&quot;&quot;,&quot;bottom&quot;:&quot;&quot;,&quot;left&quot;:&quot;&quot;,&quot;isLinked&quot;:true},&quot;element_pack_global_tooltip_border_radius&quot;:{&quot;unit&quot;:&quot;px&quot;,&quot;top&quot;:&quot;&quot;,&quot;right&quot;:&quot;&quot;,&quot;bottom&quot;:&quot;&quot;,&quot;left&quot;:&quot;&quot;,&quot;isLinked&quot;:true},&quot;element_pack_global_tooltip_border_radius_tablet&quot;:{&quot;unit&quot;:&quot;px&quot;,&quot;top&quot;:&quot;&quot;,&quot;right&quot;:&quot;&quot;,&quot;bottom&quot;:&quot;&quot;,&quot;left&quot;:&quot;&quot;,&quot;isLinked&quot;:true},&quot;element_pack_global_tooltip_border_radius_mobile&quot;:{&quot;unit&quot;:&quot;px&quot;,&quot;top&quot;:&quot;&quot;,&quot;right&quot;:&quot;&quot;,&quot;bottom&quot;:&quot;&quot;,&quot;left&quot;:&quot;&quot;,&quot;isLinked&quot;:true}}\" data-elementor-post-type=\"post\">\n\t\t\t\t<div class=\"elementor-element elementor-element-3a844b8 e-flex e-con-boxed e-con e-parent\" data-id=\"3a844b8\" data-element_type=\"container\" data-e-type=\"container\">\n\t\t\t\t\t<div class=\"e-con-inner\">\n\t\t\t\t<div class=\"elementor-element elementor-element-bf4cfdd elementor-widget elementor-widget-heading\" data-id=\"bf4cfdd\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"heading.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t<h2 class=\"elementor-heading-title elementor-size-default\">AI Agents X Digital Forensics<\/h2>\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-381fab9 elementor-widget elementor-widget-text-editor\" data-id=\"381fab9\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t\t\t<p class=\"my-2 break-words\">As <strong>Artificial Intelligence<\/strong> evolves from passive tools to <strong>autonomous agents<\/strong> capable of independent action, a new digital forensics subject has emerged: the <strong>forensic analysis of AI tooling on a given system<\/strong>.<\/p><p class=\"my-2 break-words\">This article is the second chapter in an exclusive series dedicated to our latest research in <strong>identifying and exploiting the artifacts left behind<\/strong> by these programs.<\/p><p class=\"my-2 break-words\">As AI agents navigate operating systems and execute complex tasks, they etch digital signatures into logs, memory, and file structures; our goal is to reveal how investigators can decode these remnants to reconstruct the actions undertaken using such tools in modern forensic investigations.<\/p><p>This second article will be focused on the <strong>Codex <\/strong>coding agent.<\/p><hr \/>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-436bef8 elementor-widget elementor-widget-heading\" data-id=\"436bef8\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"heading.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t<h2 class=\"elementor-heading-title elementor-size-default\">What is Codex?<\/h2>\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-e8a83d5 elementor-widget elementor-widget-image\" data-id=\"e8a83d5\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"image.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<img decoding=\"async\" src=\"https:\/\/www.intrinsec.com\/wp-content\/uploads\/elementor\/thumbs\/apps.44278.14314868180609929.f8c49912-5781-408f-8963-10487f629f2d-rpikf06tuaapc80ssloc5magxzjpj9ouestjjvozjc.png\" title=\"apps.44278.14314868180609929.f8c49912-5781-408f-8963-10487f629f2d\" alt=\"apps.44278.14314868180609929.f8c49912-5781-408f-8963-10487f629f2d\" loading=\"lazy\" \/>\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-dd9ea38 elementor-widget elementor-widget-text-editor\" data-id=\"dd9ea38\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t\t\t<p><strong>Codex<\/strong> is an AI agent developed by <strong>OpenAI<\/strong> used to generate code across dozens of languages.<\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t<div class=\"elementor-element elementor-element-9db8b5a e-flex e-con-boxed e-con e-parent\" data-id=\"9db8b5a\" data-element_type=\"container\" data-e-type=\"container\">\n\t\t\t\t\t<div class=\"e-con-inner\">\n\t\t\t\t<div class=\"elementor-element elementor-element-98038a6 elementor-widget elementor-widget-heading\" data-id=\"98038a6\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"heading.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t<h2 class=\"elementor-heading-title elementor-size-default\">Valuable forensic artifacts<\/h2>\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-8341688 elementor-widget elementor-widget-text-editor\" data-id=\"8341688\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t\t\t<p>All files related to Codex can be found in <code data-sourcepos=\"6:44-6:72\"><strong>C:\\Users\\ \\.codex\\<\/strong><\/code>.<\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-7b5dc3f elementor-widget elementor-widget-heading\" data-id=\"7b5dc3f\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"heading.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t<h3 class=\"elementor-heading-title elementor-size-default\">Codex models list<\/h3>\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-5f3d497 elementor-widget elementor-widget-text-editor\" data-id=\"5f3d497\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t\t\t<p>The models list can be found in <code data-sourcepos=\"9:33-9:78\"><strong>C:\\Users\\ \\.codex\\models_cache.json<\/strong><\/code><\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-3236d3d elementor-widget elementor-widget-heading\" data-id=\"3236d3d\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"heading.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t<h3 class=\"elementor-heading-title elementor-size-default\">User prompts history<\/h3>\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-face7fe elementor-widget elementor-widget-text-editor\" data-id=\"face7fe\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t\t\t<p dir=\"auto\" data-sourcepos=\"13:1-14:79\">The list of user prompts is stored in the file <strong><code data-sourcepos=\"13:48-13:89\">C:\\Users\\ \\.codex\\history.jsonl<\/code>.<\/strong><br data-sourcepos=\"13:91-13:93\" \/>It contains only <strong data-sourcepos=\"14:18-14:25\">user<\/strong> messages and not the model response, the fields are:<\/p><ul dir=\"auto\" data-sourcepos=\"15:1-17:24\"><li data-sourcepos=\"15:1-15:31\"><code data-sourcepos=\"15:3-15:14\"><strong>session_id<\/strong><\/code> : the session ID<\/li><li data-sourcepos=\"16:1-16:36\"><code data-sourcepos=\"16:3-16:6\"><strong>all<\/strong><\/code> : the timestamp of the prompt<\/li><li data-sourcepos=\"17:1-18:0\"><code data-sourcepos=\"17:3-17:8\"><strong>text<\/strong><\/code> the user prompt<\/li><\/ul>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-86b5cd4 elementor-widget elementor-widget-heading\" data-id=\"86b5cd4\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"heading.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t<h3 class=\"elementor-heading-title elementor-size-default\">Configuration file<\/h3>\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t<div class=\"elementor-element elementor-element-db71fd2 e-flex e-con-boxed e-con e-parent\" data-id=\"db71fd2\" data-element_type=\"container\" data-e-type=\"container\">\n\t\t\t\t\t<div class=\"e-con-inner\">\n\t\t\t\t<div class=\"elementor-element elementor-element-61ce9ef elementor-widget elementor-widget-text-editor\" data-id=\"61ce9ef\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t\t\t<p>The configuration file for Codex can be found in <strong><code data-sourcepos=\"21:50-21:89\">C:\\Users\\ \\.codex\\config.toml<\/code>.<\/strong><\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-bfa7fa3 elementor-widget elementor-widget-heading\" data-id=\"bfa7fa3\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"heading.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t<h3 class=\"elementor-heading-title elementor-size-default\">Authentication information<\/h3>\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-2fae5b9 elementor-widget elementor-widget-text-editor\" data-id=\"2fae5b9\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t\t\t<p>The file <code data-sourcepos=\"25:10-25:47\"><strong>C:\\Users\\ \\.codex\\auth.json<\/strong><\/code> can be interesting in a digital forensics investigation as it contains authentication information such as API keys, access tokens, etc.<\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-561fabb elementor-widget elementor-widget-heading\" data-id=\"561fabb\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"heading.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t<h3 class=\"elementor-heading-title elementor-size-default\">Skills-related data<\/h3>\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-8483956 elementor-widget elementor-widget-text-editor\" data-id=\"8483956\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t\t\t<p>In the folder <code data-sourcepos=\"29:15-29:50\"><strong>C:\\Users\\ \\.codex\\skills\\<\/strong><\/code> built-in skills and installed ones can be found.<\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-71f55d9 elementor-widget elementor-widget-heading\" data-id=\"71f55d9\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"heading.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t<h3 class=\"elementor-heading-title elementor-size-default\">Sessions history<\/h3>\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-f0cb89a elementor-widget elementor-widget-text-editor\" data-id=\"f0cb89a\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t\t\t<p dir=\"auto\" data-sourcepos=\"33:1-33:146\">The full session history can be found in <code data-sourcepos=\"33:42-33:145\"><strong>C:\\Users\\ \\.codex\\sessions\\ \\ \\<dd> \\rollout- - .jsonl<\/strong><\/code>.<\/p><p dir=\"auto\" data-sourcepos=\"35:1-35:131\">In this file we can find <strong>user inputs<\/strong> where <code data-sourcepos=\"35:44-35:49\">kind<\/code> == <code data-sourcepos=\"35:54-35:64\">event_msg<\/code> and <code data-sourcepos=\"35:70-35:83\">payload.type<\/code> == <code data-sourcepos=\"35:88-35:101\">user_message<\/code>. The interesting fields are:<\/p><ul dir=\"auto\" data-sourcepos=\"36:1-38:48\"><li data-sourcepos=\"36:1-36:49\"><code data-sourcepos=\"36:3-36:13\">timestamp<\/code> : the timestamp of the user message<\/li><li data-sourcepos=\"37:1-37:33\"><code data-sourcepos=\"37:3-37:19\">payload.message<\/code> : the message<\/li><li data-sourcepos=\"38:1-38:48\"><code data-sourcepos=\"38:3-38:18\">payload.images<\/code> : if the user provided images<\/li><\/ul><p dir=\"auto\" data-sourcepos=\"40:1-40:127\">We can also find <strong>agent response<\/strong> where <code data-sourcepos=\"40:39-40:44\">kind<\/code> == <code data-sourcepos=\"40:49-40:59\">event_msg<\/code> and <code data-sourcepos=\"40:65-40:78\">payload.type<\/code> == <code data-sourcepos=\"40:83-40:97\">agent_message<\/code>. The interesting fields are:<\/p><ul dir=\"auto\" data-sourcepos=\"41:1-43:48\"><li data-sourcepos=\"41:1-41:49\"><code data-sourcepos=\"41:3-41:13\">timestamp<\/code> : the timestamp of the user message<\/li><li data-sourcepos=\"42:1-42:40\"><code data-sourcepos=\"42:3-42:19\">payload.message<\/code> the agent response<\/li><li data-sourcepos=\"43:1-43:48\"><code data-sourcepos=\"43:3-43:18\">payload.images<\/code> : if the user provided images<\/li><\/ul><p dir=\"auto\" data-sourcepos=\"45:1-45:157\">After each agent response, a <strong>summary of token usage<\/strong> is provided where <code data-sourcepos=\"45:71-45:76\">kind<\/code> == <code data-sourcepos=\"45:81-45:91\">event_msg<\/code> and <code data-sourcepos=\"45:97-45:110\">payload.type<\/code> == <code data-sourcepos=\"45:115-45:127\">token_count<\/code>. The interesting fields are:<\/p><ul dir=\"auto\" data-sourcepos=\"46:1-57:65\"><li data-sourcepos=\"46:1-46:13\"><code data-sourcepos=\"46:3-46:13\">timestamp<\/code><\/li><li data-sourcepos=\"47:1-47:93\"><code data-sourcepos=\"47:3-47:47\">payload.info.total_token_usage.input_tokens<\/code> : total input tokens consumed for the session<\/li><li data-sourcepos=\"48:1-48:107\"><code data-sourcepos=\"48:3-48:54\">payload.info.total_token_usage.cached_input_tokens<\/code> : total cached input tokens consumed for the session<\/li><li data-sourcepos=\"49:1-49:95\"><code data-sourcepos=\"49:3-49:48\">payload.info.total_token_usage.output_tokens<\/code> : total output tokens consumed for the session<\/li><li data-sourcepos=\"50:1-50:115\"><code data-sourcepos=\"50:3-50:58\">payload.info.total_token_usage.reasoning_output_tokens<\/code> : total reasoning output tokens consumed for the session<\/li><li data-sourcepos=\"51:1-51:87\"><code data-sourcepos=\"51:3-51:47\">payload.info.total_token_usage.total_tokens<\/code> : total tokens consumed for the session<\/li><li data-sourcepos=\"52:1-52:98\"><code data-sourcepos=\"52:3-52:46\">payload.info.last_token_usage.input_tokens<\/code> : total input tokens consumed for the last response<\/li><li data-sourcepos=\"53:1-53:112\"><code data-sourcepos=\"53:3-53:53\">payload.info.last_token_usage.cached_input_tokens<\/code> : total cached input tokens consumed for the last response<\/li><li data-sourcepos=\"54:1-54:100\"><code data-sourcepos=\"54:3-54:47\">payload.info.last_token_usage.output_tokens<\/code> : total output tokens consumed for the last response<\/li><li data-sourcepos=\"55:1-55:120\"><code data-sourcepos=\"55:3-55:57\">payload.info.last_token_usage.reasoning_output_tokens<\/code> : total reasoning output tokens consumed for the last response<\/li><li data-sourcepos=\"56:1-56:92\"><code data-sourcepos=\"56:3-56:46\">payload.info.last_token_usage.total_tokens<\/code> : total tokens consumed for the last response<\/li><li data-sourcepos=\"57:1-57:65\"><code data-sourcepos=\"57:3-57:37\">payload.info.model_context_window<\/code> : model context window size<\/li><\/ul>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-c1d4964 elementor-widget elementor-widget-heading\" data-id=\"c1d4964\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"heading.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t<h3 class=\"elementor-heading-title elementor-size-default\">About our CERT team<\/h3>\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-4cfe27a elementor-widget elementor-widget-heading\" data-id=\"4cfe27a\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"heading.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t<p class=\"elementor-heading-title elementor-size-default\">About the CERT Intrinsec This analysis was produced by the CERT Intrinsec \u2014 our incident response and digital forensics team. As a PRIS-qualified CERT (member of InterCERT France and the Campus Cyber), we investigate identity compromises like the AiTM scenarios described above every day, from the initial phish to persistent access, and help organizations detect, contain, and remediate them. Wherever you are on that journey, our teams can help:<\/p>\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-7299cbb elementor-widget elementor-widget-button\" data-id=\"7299cbb\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"button.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t\t\t<div class=\"elementor-button-wrapper\">\n\t\t\t\t\t<a class=\"elementor-button elementor-button-link elementor-size-sm\" href=\"\/en\/abonnement-cert\/\">\n\t\t\t\t\t\t<span class=\"elementor-button-content-wrapper\">\n\t\t\t\t\t\t\t\t\t<span class=\"elementor-button-text\">Learn more<\/span>\n\t\t\t\t\t<\/span>\n\t\t\t\t\t<\/a>\n\t\t\t\t<\/div>\n\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>","protected":false},"excerpt":{"rendered":"<p>As Artificial Intelligence evolves from passive tools to autonomous agents capable of independent action, a new digital forensics subject has emerged: the forensic analysis of AI tooling on a given system.<\/p>\n<p>This article is the second chapter in an exclusive series dedicated to our latest research in identifying and exploiting the artifacts left behind by these programs.<\/p>","protected":false},"author":55,"featured_media":232356,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[6],"tags":[374,375,373,176],"class_list":["post-232216","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-cert","tag-ai","tag-artificial-intelligence","tag-digital-forensics","tag-incident-response"],"yoast_head":"<!-- This site is optimized with the Yoast SEO Premium plugin v28.0 (Yoast SEO v28.1) - https:\/\/yoast.com\/product\/yoast-seo-premium-wordpress\/ -->\n<title>OpenAI Codex Forensics: Investigating AI Artifacts<\/title>\n<meta name=\"description\" content=\"Discover the forensic artifacts left by OpenAI Codex on Windows and learn how investigators can reconstruct AI agent activity from system\" \/>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/www.intrinsec.com\/en\/ai-agents-digital-forensics-openai-codex-artifacts\/\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"AI Agents X Digital Forensics 02 - Codex\" \/>\n<meta property=\"og:description\" content=\"Discover the forensic artifacts left by OpenAI Codex on Windows and learn how investigators can reconstruct AI agent activity from system\" \/>\n<meta property=\"og:url\" content=\"https:\/\/www.intrinsec.com\/en\/ai-agents-digital-forensics-openai-codex-artifacts\/\" \/>\n<meta property=\"og:site_name\" content=\"INTRINSEC\" \/>\n<meta property=\"article:published_time\" content=\"2026-07-31T10:00:00+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/www.intrinsec.com\/wp-content\/uploads\/2026\/07\/Trouble-in-the-air-une-vague-de-campagnes-ciblant-lindustrie-aerospatiale-en-Russie-16.png\" \/>\n\t<meta property=\"og:image:width\" content=\"1200\" \/>\n\t<meta property=\"og:image:height\" content=\"1200\" \/>\n\t<meta property=\"og:image:type\" content=\"image\/png\" \/>\n<meta name=\"author\" content=\"CERT Intrinsec\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:creator\" content=\"@Intrinsec\" \/>\n<meta name=\"twitter:site\" content=\"@Intrinsec\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"CERT Intrinsec\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"3 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\\\/\\\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\\\/\\\/www.intrinsec.com\\\/ai-agents-digital-forensics-openai-codex-artifacts\\\/#article\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/www.intrinsec.com\\\/ai-agents-digital-forensics-openai-codex-artifacts\\\/\"},\"author\":{\"name\":\"CERT Intrinsec\",\"@id\":\"https:\\\/\\\/www.intrinsec.com\\\/#\\\/schema\\\/person\\\/1ec04601123170d245331ea69b78356e\"},\"headline\":\"AI Agents X Digital Forensics 02 &#8211; Codex\",\"datePublished\":\"2026-07-31T10:00:00+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\\\/\\\/www.intrinsec.com\\\/ai-agents-digital-forensics-openai-codex-artifacts\\\/\"},\"wordCount\":485,\"publisher\":{\"@id\":\"https:\\\/\\\/www.intrinsec.com\\\/#organization\"},\"image\":{\"@id\":\"https:\\\/\\\/www.intrinsec.com\\\/ai-agents-digital-forensics-openai-codex-artifacts\\\/#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/www.intrinsec.com\\\/wp-content\\\/uploads\\\/2026\\\/07\\\/Trouble-in-the-air-une-vague-de-campagnes-ciblant-lindustrie-aerospatiale-en-Russie-16.png\",\"keywords\":[\"AI\",\"Artificial Intelligence\",\"Digital Forensics\",\"Incident Response\"],\"articleSection\":[\"CERT\"],\"inLanguage\":\"en-US\"},{\"@type\":\"WebPage\",\"@id\":\"https:\\\/\\\/www.intrinsec.com\\\/ai-agents-digital-forensics-openai-codex-artifacts\\\/\",\"url\":\"https:\\\/\\\/www.intrinsec.com\\\/ai-agents-digital-forensics-openai-codex-artifacts\\\/\",\"name\":\"OpenAI Codex Forensics: Investigating AI Artifacts\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/www.intrinsec.com\\\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\\\/\\\/www.intrinsec.com\\\/ai-agents-digital-forensics-openai-codex-artifacts\\\/#primaryimage\"},\"image\":{\"@id\":\"https:\\\/\\\/www.intrinsec.com\\\/ai-agents-digital-forensics-openai-codex-artifacts\\\/#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/www.intrinsec.com\\\/wp-content\\\/uploads\\\/2026\\\/07\\\/Trouble-in-the-air-une-vague-de-campagnes-ciblant-lindustrie-aerospatiale-en-Russie-16.png\",\"datePublished\":\"2026-07-31T10:00:00+00:00\",\"description\":\"Discover the forensic artifacts left by OpenAI Codex on Windows and learn how investigators can reconstruct AI agent activity from system\",\"breadcrumb\":{\"@id\":\"https:\\\/\\\/www.intrinsec.com\\\/ai-agents-digital-forensics-openai-codex-artifacts\\\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\\\/\\\/www.intrinsec.com\\\/ai-agents-digital-forensics-openai-codex-artifacts\\\/\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/www.intrinsec.com\\\/ai-agents-digital-forensics-openai-codex-artifacts\\\/#primaryimage\",\"url\":\"https:\\\/\\\/www.intrinsec.com\\\/wp-content\\\/uploads\\\/2026\\\/07\\\/Trouble-in-the-air-une-vague-de-campagnes-ciblant-lindustrie-aerospatiale-en-Russie-16.png\",\"contentUrl\":\"https:\\\/\\\/www.intrinsec.com\\\/wp-content\\\/uploads\\\/2026\\\/07\\\/Trouble-in-the-air-une-vague-de-campagnes-ciblant-lindustrie-aerospatiale-en-Russie-16.png\",\"width\":1200,\"height\":1200,\"caption\":\"codex forensics\"},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\\\/\\\/www.intrinsec.com\\\/ai-agents-digital-forensics-openai-codex-artifacts\\\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Accueil\",\"item\":\"https:\\\/\\\/www.intrinsec.com\\\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"AI Agents X Digital Forensics 02 &#8211; Codex\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\\\/\\\/www.intrinsec.com\\\/#website\",\"url\":\"https:\\\/\\\/www.intrinsec.com\\\/\",\"name\":\"INTRINSEC\",\"description\":\"Notre m\u00e9tier , Prot\u00e9ger le v\u00f4tre\",\"publisher\":{\"@id\":\"https:\\\/\\\/www.intrinsec.com\\\/#organization\"},\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\\\/\\\/www.intrinsec.com\\\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"},{\"@type\":\"Organization\",\"@id\":\"https:\\\/\\\/www.intrinsec.com\\\/#organization\",\"name\":\"INTRINSEC\",\"alternateName\":\"ISEC\",\"url\":\"https:\\\/\\\/www.intrinsec.com\\\/\",\"logo\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/www.intrinsec.com\\\/#\\\/schema\\\/logo\\\/image\\\/\",\"url\":\"https:\\\/\\\/www.intrinsec.com\\\/wp-content\\\/uploads\\\/2025\\\/02\\\/libellule.png\",\"contentUrl\":\"https:\\\/\\\/www.intrinsec.com\\\/wp-content\\\/uploads\\\/2025\\\/02\\\/libellule.png\",\"width\":1322,\"height\":1322,\"caption\":\"INTRINSEC\"},\"image\":{\"@id\":\"https:\\\/\\\/www.intrinsec.com\\\/#\\\/schema\\\/logo\\\/image\\\/\"},\"sameAs\":[\"https:\\\/\\\/x.com\\\/Intrinsec\",\"https:\\\/\\\/fr.linkedin.com\\\/company\\\/intrinsec\",\"https:\\\/\\\/www.youtube.com\\\/channel\\\/UC0trUZAHNZOUbxYnNdecM4A\"],\"description\":\"soci\u00e9t\u00e9 de consulting, pure player cybers\u00e9curit\u00e9 fran\u00e7ais et europ\u00e9en depuis plus de 30ans, sp\u00e9cialiste dans la s\u00e9curit\u00e9 offensive & audit (pentest\\\/red team), GRC, et services IMSS comme le SOC, CTI et CERT Intrinsec est qualifi\u00e9 PASSI Elev\u00e9, PRIS Elev\u00e9 et PACS par l'ANSSI\",\"email\":\"contact@intrinsec.com\"},{\"@type\":\"Person\",\"@id\":\"https:\\\/\\\/www.intrinsec.com\\\/#\\\/schema\\\/person\\\/1ec04601123170d245331ea69b78356e\",\"name\":\"CERT Intrinsec\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/48491cc0395b3eed17e56104e0ad5a174d5133baeb103718533f3bc781e03778?s=96&d=retro&r=g\",\"url\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/48491cc0395b3eed17e56104e0ad5a174d5133baeb103718533f3bc781e03778?s=96&d=retro&r=g\",\"contentUrl\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/48491cc0395b3eed17e56104e0ad5a174d5133baeb103718533f3bc781e03778?s=96&d=retro&r=g\",\"caption\":\"CERT Intrinsec\"},\"sameAs\":[\"https:\\\/\\\/www.intrinsec.com\\\/category\\\/cert\\\/\"],\"url\":\"https:\\\/\\\/www.intrinsec.com\\\/en\\\/author\\\/certintrinsec\\\/\"}]}<\/script>\n<!-- \/ Yoast SEO Premium plugin. -->","yoast_head_json":{"title":"OpenAI Codex Forensics: Investigating AI Artifacts","description":"Discover the forensic artifacts left by OpenAI Codex on Windows and learn how investigators can reconstruct AI agent activity from system","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/www.intrinsec.com\/en\/ai-agents-digital-forensics-openai-codex-artifacts\/","og_locale":"en_US","og_type":"article","og_title":"AI Agents X Digital Forensics 02 - Codex","og_description":"Discover the forensic artifacts left by OpenAI Codex on Windows and learn how investigators can reconstruct AI agent activity from system","og_url":"https:\/\/www.intrinsec.com\/en\/ai-agents-digital-forensics-openai-codex-artifacts\/","og_site_name":"INTRINSEC","article_published_time":"2026-07-31T10:00:00+00:00","og_image":[{"width":1200,"height":1200,"url":"https:\/\/www.intrinsec.com\/wp-content\/uploads\/2026\/07\/Trouble-in-the-air-une-vague-de-campagnes-ciblant-lindustrie-aerospatiale-en-Russie-16.png","type":"image\/png"}],"author":"CERT Intrinsec","twitter_card":"summary_large_image","twitter_creator":"@Intrinsec","twitter_site":"@Intrinsec","twitter_misc":{"Written by":"CERT Intrinsec","Est. reading time":"3 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/www.intrinsec.com\/ai-agents-digital-forensics-openai-codex-artifacts\/#article","isPartOf":{"@id":"https:\/\/www.intrinsec.com\/ai-agents-digital-forensics-openai-codex-artifacts\/"},"author":{"name":"CERT Intrinsec","@id":"https:\/\/www.intrinsec.com\/#\/schema\/person\/1ec04601123170d245331ea69b78356e"},"headline":"AI Agents X Digital Forensics 02 &#8211; Codex","datePublished":"2026-07-31T10:00:00+00:00","mainEntityOfPage":{"@id":"https:\/\/www.intrinsec.com\/ai-agents-digital-forensics-openai-codex-artifacts\/"},"wordCount":485,"publisher":{"@id":"https:\/\/www.intrinsec.com\/#organization"},"image":{"@id":"https:\/\/www.intrinsec.com\/ai-agents-digital-forensics-openai-codex-artifacts\/#primaryimage"},"thumbnailUrl":"https:\/\/www.intrinsec.com\/wp-content\/uploads\/2026\/07\/Trouble-in-the-air-une-vague-de-campagnes-ciblant-lindustrie-aerospatiale-en-Russie-16.png","keywords":["AI","Artificial Intelligence","Digital Forensics","Incident Response"],"articleSection":["CERT"],"inLanguage":"en-US"},{"@type":"WebPage","@id":"https:\/\/www.intrinsec.com\/ai-agents-digital-forensics-openai-codex-artifacts\/","url":"https:\/\/www.intrinsec.com\/ai-agents-digital-forensics-openai-codex-artifacts\/","name":"OpenAI Codex Forensics: Investigating AI Artifacts","isPartOf":{"@id":"https:\/\/www.intrinsec.com\/#website"},"primaryImageOfPage":{"@id":"https:\/\/www.intrinsec.com\/ai-agents-digital-forensics-openai-codex-artifacts\/#primaryimage"},"image":{"@id":"https:\/\/www.intrinsec.com\/ai-agents-digital-forensics-openai-codex-artifacts\/#primaryimage"},"thumbnailUrl":"https:\/\/www.intrinsec.com\/wp-content\/uploads\/2026\/07\/Trouble-in-the-air-une-vague-de-campagnes-ciblant-lindustrie-aerospatiale-en-Russie-16.png","datePublished":"2026-07-31T10:00:00+00:00","description":"Discover the forensic artifacts left by OpenAI Codex on Windows and learn how investigators can reconstruct AI agent activity from system","breadcrumb":{"@id":"https:\/\/www.intrinsec.com\/ai-agents-digital-forensics-openai-codex-artifacts\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/www.intrinsec.com\/ai-agents-digital-forensics-openai-codex-artifacts\/"]}]},{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.intrinsec.com\/ai-agents-digital-forensics-openai-codex-artifacts\/#primaryimage","url":"https:\/\/www.intrinsec.com\/wp-content\/uploads\/2026\/07\/Trouble-in-the-air-une-vague-de-campagnes-ciblant-lindustrie-aerospatiale-en-Russie-16.png","contentUrl":"https:\/\/www.intrinsec.com\/wp-content\/uploads\/2026\/07\/Trouble-in-the-air-une-vague-de-campagnes-ciblant-lindustrie-aerospatiale-en-Russie-16.png","width":1200,"height":1200,"caption":"codex forensics"},{"@type":"BreadcrumbList","@id":"https:\/\/www.intrinsec.com\/ai-agents-digital-forensics-openai-codex-artifacts\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Accueil","item":"https:\/\/www.intrinsec.com\/"},{"@type":"ListItem","position":2,"name":"AI Agents X Digital Forensics 02 &#8211; Codex"}]},{"@type":"WebSite","@id":"https:\/\/www.intrinsec.com\/#website","url":"https:\/\/www.intrinsec.com\/","name":"INTRINSEC","description":"Our job is to protect yours.","publisher":{"@id":"https:\/\/www.intrinsec.com\/#organization"},"potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/www.intrinsec.com\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":"Organization","@id":"https:\/\/www.intrinsec.com\/#organization","name":"INTRINSEC","alternateName":"ISEC","url":"https:\/\/www.intrinsec.com\/","logo":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.intrinsec.com\/#\/schema\/logo\/image\/","url":"https:\/\/www.intrinsec.com\/wp-content\/uploads\/2025\/02\/libellule.png","contentUrl":"https:\/\/www.intrinsec.com\/wp-content\/uploads\/2025\/02\/libellule.png","width":1322,"height":1322,"caption":"INTRINSEC"},"image":{"@id":"https:\/\/www.intrinsec.com\/#\/schema\/logo\/image\/"},"sameAs":["https:\/\/x.com\/Intrinsec","https:\/\/fr.linkedin.com\/company\/intrinsec","https:\/\/www.youtube.com\/channel\/UC0trUZAHNZOUbxYnNdecM4A"],"description":"Intrinsec, a consulting firm and pure-play French and European cybersecurity provider for over 30 years, specializes in offensive security and auditing (penetration testing\/red teams), GRC, and IMSS services such as SOC, CTI, and CERT. Intrinsec is qualified at PASSI High, PRIS High, and PACS levels by ANSSI.","email":"contact@intrinsec.com"},{"@type":"Person","@id":"https:\/\/www.intrinsec.com\/#\/schema\/person\/1ec04601123170d245331ea69b78356e","name":"Intrinsic CERT","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/secure.gravatar.com\/avatar\/48491cc0395b3eed17e56104e0ad5a174d5133baeb103718533f3bc781e03778?s=96&d=retro&r=g","url":"https:\/\/secure.gravatar.com\/avatar\/48491cc0395b3eed17e56104e0ad5a174d5133baeb103718533f3bc781e03778?s=96&d=retro&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/48491cc0395b3eed17e56104e0ad5a174d5133baeb103718533f3bc781e03778?s=96&d=retro&r=g","caption":"CERT Intrinsec"},"sameAs":["https:\/\/www.intrinsec.com\/category\/cert\/"],"url":"https:\/\/www.intrinsec.com\/en\/author\/certintrinsec\/"}]}},"_links":{"self":[{"href":"https:\/\/www.intrinsec.com\/en\/wp-json\/wp\/v2\/posts\/232216","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.intrinsec.com\/en\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.intrinsec.com\/en\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.intrinsec.com\/en\/wp-json\/wp\/v2\/users\/55"}],"replies":[{"embeddable":true,"href":"https:\/\/www.intrinsec.com\/en\/wp-json\/wp\/v2\/comments?post=232216"}],"version-history":[{"count":16,"href":"https:\/\/www.intrinsec.com\/en\/wp-json\/wp\/v2\/posts\/232216\/revisions"}],"predecessor-version":[{"id":232355,"href":"https:\/\/www.intrinsec.com\/en\/wp-json\/wp\/v2\/posts\/232216\/revisions\/232355"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.intrinsec.com\/en\/wp-json\/wp\/v2\/media\/232356"}],"wp:attachment":[{"href":"https:\/\/www.intrinsec.com\/en\/wp-json\/wp\/v2\/media?parent=232216"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.intrinsec.com\/en\/wp-json\/wp\/v2\/categories?post=232216"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.intrinsec.com\/en\/wp-json\/wp\/v2\/tags?post=232216"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}