I discovered that an AI coding CLI had stored hundreds of session transcripts locally: about 787 JSONL files totaling 1.1 GB, with one project accounting for most of the space. Each file includes prompts, responses, tool calls, command output, and sometimes the contents of files or credentials pasted into the session.
The files live under the user profile in a project-and-session directory, so they may also be included in profile backups. The biggest concern is not the disk usage but the possibility of plaintext secrets, connection strings, authorization headers, or sensitive logs remaining on the endpoint for weeks.
The tool appears to clean up sessions after a configurable retention period, with a default of roughly 30 days, but that still leaves a substantial exposure window. For a managed fleet, should these directories be treated as sensitive data, excluded from backups, encrypted with the user profile, or purged more aggressively? How are other teams handling this?
4 Answers
The main fix is preventing secrets from entering the transcript in the first place. Use a secret manager and inject credentials at runtime, rather than pasting .env files, tokens, or connection strings into an AI session. Short-lived credentials and automatic rotation also reduce the damage if something is accidentally logged. Backup exclusions and retention rules are still useful, but they are cleanup and containment—not the primary control.
Treat the directory like any other developer artifact that can contain source code and credentials. Use full-disk encryption, restrict local access, apply endpoint monitoring where appropriate, exclude it from broad profile backups if policy allows, and set a documented retention period. Also include AI-session data in offboarding and device-reuse procedures.
A user profile normally is not readable by other standard users, but local administrators or anyone exploiting the endpoint can potentially access it. Encryption and endpoint controls still matter.
There is usually built-in cleanup for these session files; the default retention is around 30 days and can often be shortened, subject to the tool's minimum setting. That corrects the assumption that the files remain forever, but it does not eliminate the risk during the retention window or address copies made by backups.
This needs to be handled as a governance issue as well as a filesystem issue. Restrict which AI tools employees can install, provide training on prohibited data, define approved models and retention rules, and use DLP or enterprise controls where available. The organization should know whether proprietary data is being sent to an external service, while still recognizing that local transcripts may not be covered well by existing DLP tools.
Exactly. If the agent never sees a long-lived secret in plaintext, the transcript is far less valuable to an attacker. The local logs should still be classified as sensitive, though.