Get into the mind of AI agents. Read their memories. Rewrite their instructions.

Security research toolkit for auditing the local attack surface of AI coding assistants.

Zero dependencies, Python 3.10+ standard library only.

1. extractor.py - Extract conversation history from 10 AI tools
2. injector.py - Scan injection surfaces, demonstrate 56 attack scenarios
3. mindjack report - Generate interactive HTML attack graph with OWASP compliance mapping

Disclaimer: For authorized security testing, red teaming, CTF challenges, and AI safety research only. Always obtain proper authorization before testing on systems you don't own.

git clone https://github.com/7h30th3r0n3/MindJack.git
cd MindJack

# Extract all conversations
python3 extractor.py

# Scan for injection surfaces
python3 injector.py scan

# List all 33 attack recipes
python3 injector.py recipes

# Dry-run an injection (safe, no modifications)
python3 injector.py inject --recipe claude-memory-poison --dry-run

# Generate interactive HTML attack report
pip install -e .
mindjack report --scope ~ --allow-home-scope --existing-only -o report.html

Reads local conversation data from all supported AI tools and exports to JSON + Markdown.

python3 extractor.py                                  # Extract everything
python3 extractor.py -o ~/export                       # Custom output dir
python3 extractor.py --json-only                       # Skip Markdown report
python3 extractor.py --sources claude-code codex-cli   # Specific tools only

ai_history_export/
  all_conversations.json       # Everything combined
  claude-code.json             # Per-source files
  codex-cli-session.json
  copilot.json
  ...
  REPORT.md                    # Human-readable summary

{
  "source": "claude-code",
  "session_id": "abc123-...",
  "project": "/home/user/myproject",
  "date": "2026-03-21",
  "message_count": 42,
  "messages": [
    {"role": "user", "content": "fix the login bug", "timestamp": "2026-03-21T08:15:00+00:00"},
    {"role": "assistant", "content": "Looking at the auth module...", "timestamp": null}
  ]
}

Scans and demonstrates file-based prompt injection and configuration poisoning across AI coding assistants.

# Scan - discover all injectable targets
python3 injector.py scan
python3 injector.py scan --json targets.json

# Recipes - list all 33 predefined attack scenarios
python3 injector.py recipes

# Inject - execute (always --dry-run first!)
python3 injector.py inject --recipe <name> --dry-run
python3 injector.py inject --recipe <name>
python3 injector.py inject --payload "your text" --tool claude-code --category memory --dry-run
python3 injector.py inject --payload-file evil.txt --tool cursor --dry-run
python3 injector.py inject --payload-preset exfiltrate_secrets --existing-only --dry-run

# Clean - remove all injections, restore backups
python3 injector.py clean
python3 injector.py clean --dry-run

Presets can be injected into any target with --payload-preset:

• --dry-run previews all changes without modifying files
• Automatic backups (.agentscan.bak) before any modification
• clean command restores all files from backups
• Injection markers (<!-- AGENTSCAN-INJECTION -->) for identification
• Double injection prevention - skips files already injected
• Recipe target filtering - recipes only inject into their declared targets
• JSON parse safety - refuses to overwrite files it cannot parse

Some files are read by multiple tools, making them high-value targets:

A single AGENTS.md in a cloned repo can silently poison 5+ AI tools.

Every MindJack scenario maps to real-world vulnerabilities catalogued by OWASP.

Source: genai.owasp.org/resource/owasp-top-10-for-llm-applications-2025

Source: genai.owasp.org/resource/owasp-top-10-for-agentic-applications-for-2026

LLM08 (Vector and Embedding Weaknesses) is the only entry not covered - it relates to RAG pipeline internals, not local file-based attack surfaces.

MindJack v2 includes an installable module that generates a self-contained interactive HTML report with attack path analysis.

pip install -e .

# Full report with all tools
mindjack report --scope ~ --allow-home-scope -o report.html

# Only include tools with existing artifacts
mindjack report --scope ~ --allow-home-scope --existing-only -o report.html

# Scan specific project directory
mindjack report --scope /path/to/project -o report.html

mindjack discover --scope ~ --allow-home-scope    # Discover artifacts and surfaces
mindjack assess --scope ~ --allow-home-scope       # Full assessment with JSON/MD reports
mindjack graph --scope ~ --allow-home-scope        # Export trust graph as JSON
mindjack tools list                                 # List supported tool plugins
mindjack tools probe                                # Detect installed AI tools

The toolkit includes several protections for safe operation:

• File size limits (50 MB max) prevent OOM on malformed files
• Symlink escape detection rejects paths that resolve outside expected directories
• Environment variable validation warns when CODEX_HOME points outside home
• Markdown content escaping prevents injection in generated reports
• Safe SQLite handling with context managers and error reporting
• Permission-aware traversal silently skips inaccessible directories

Both tools run 100% locally. No data is sent anywhere. No network calls. Add ai_history_export/ to .gitignore.

PRs welcome! To add a new tool:

1. Extractor: Add extract_<tool>(), register in EXTRACTORS
2. Injector: Add discover_<tool>(), register in ALL_DISCOVERERS, add recipes to RECIPES
3. Update this README

MIT