Tracing AI-Assisted IDEs: Forensic Artifacts, Agent Observability, and Software Supply Chain Risk

AI-assisted IDEs and coding tools are becoming part of normal developer workstation activity, but most DFIR playbooks still treat them as background applications rather than forensic evidence sources. This creates a visibility gap during developer compromise and software supply chain investigations: responders may see file changes, package installs, or repository activity, but miss the local session context, tool activity, workspace state, and configuration that explain how those actions occurred. This session presents a DFIR-focused artifact study of AI-assisted developer environments such as VS Code with GitHub Copilot, Cursor, Claude Code, Codex, and related IDE- or terminal-based coding assistants. The research will compare the local traces these tools can leave behind, including session history, workspace context, prompts, tool outputs, command traces, debug logs, extension data, configuration files, local observability records, and repository-level instructions. It will also examine how these environments intersect with traditional attacker targets such as environment variables, API tokens, SSH keys, credential stores, package-manager credentials, and source-control authentication. The talk will map these artifacts to realistic investigation scenarios involving malicious packages, suspicious editor or extension behavior, credential exposure, risky activities, and downstream CI/CD abuse. The focus will be on how these artifacts can be parsed, what important activity can already be observed through current EDR, endpoint, editor, source-control, and enterprise telemetry, and where visibility gaps remain for responders investigating compromised developer workstations. The session will also discuss open-source tooling opportunities to make this analysis easier: lightweight collectors, artifact parsers, timeline builders, and triage helpers focused on AI-assisted developer environments. Attendees will leave with a practical artifact map, telemetry checklist, monitoring considerations, and investigation ideas for developer workstations that may serve as an initial access path into the software supply chain.