# Reconstructing AI Agent Activity: Two New Scripts for Forensic Review, (Thu, Oct 8th)

> **Key Architectural Takeaway:** We just did a major update to FOR577 and added a lot of new material on day 5 about investigating AI usage in incident response.

**Published:** 2026-10-08T16:52:53+00:00  
**Source:** SANS Internet Storm Center  
**Category:** cybersecurity  
**Canonical URL:** https://fosswire.org/news/reconstructing-ai-agent-activity-two-new-scripts-for-forensi.html  

## Executive Summary
We just did a major update to FOR577 and added a lot of new material on day 5 about investigating AI usage in incident response. In the new material we dicsuss 8&#;x26;#;xc2;&#;x26;#;xa0;of the most popular AI coding assistants and&#;x26;#;xc2;&#;x26;#;xa0;agents including Claude Code, Codex, Gemini CLI, Cursor, Copilot, Warp, Windsurf, and Qwen Code. I&#;x26;#;39;ve been using Claude Code and a little bit of Codex, but I also have recently been playing with OpenCode and am setting up Hermes.

## Architectural & Systems Analysis
From an artificial intelligence architecture, model weights governance, and inference efficiency perspective:

- **Weights Accessibility & Sovereignty:** Evaluates whether weights are open for private self-hosting or locked behind centralized cloud APIs.
- **Quantization & Edge Performance:** Kernel optimizations (4-bit/8-bit GGUF, AWQ, EXL2) allow high tokens-per-second on consumer GPUs and Apple Silicon.
- **Reasoning & Architectural Scaling:** Scrutinizes mixture-of-experts (MoE), attention mechanisms, and fine-tuning datasets against open community benchmarks.

## Impact on the Open Ecosystem
Protects developers and enterprises from proprietary black-box entrapment, fostering auditable, sovereign AI infrastructure.