Evidence Capture, Export, and Reproducibility

Overview

Every finding an agent files carries the raw material behind it — the request that triggered it, the response that proved it, a screenshot, or the command that surfaced it.

This article covers what gets captured, how the agent records it, how those recorded artifacts are reused to reproduce and validate a finding later, and how to export evidence out of the platform.

1. Evidence Types

A finding can carry several kinds of evidence, each attached to the finding record itself.

Evidence Type

What It Proves

Screenshot

Visual state at the moment the finding was observed

Request/Response Pair

The exact HTTP exchange that produced the result

HAR File

A full recorded browser session leading to the finding

Exploit Script

The exact steps used to trigger the vulnerability

Command Output

The exact command run and what it returned


2. How the Agent Records Evidence

Evidence is captured at the moment the agent does the work that produces it, not reconstructed afterward.

When an agent files a finding, it attaches the supporting file — a screenshot, a saved request/response transcript, a HAR, or a script — directly to that finding, and a reference to it is embedded inline in the finding’s own description so the evidence renders in place on the finding page and in every generated report.

Findings from automated testing additionally carry the request and response as structured fields on the finding record itself. Separately, the full session of a workspace chat — every command the agent ran and what it returned — is preserved as part of that chat’s history for as long as the workspace exists.


3. Reusing Recorded Artifacts to Reproduce and Validate Findings

Because the exact artifact behind a finding is preserved rather than summarized, that same artifact can be replayed to check whether the finding still holds.

A stored request/response pair can be resent against the same target to confirm the vulnerability is still present. A recorded command can be re-run the same way to confirm the same result. A screenshot gives a fixed point of comparison even if the live system has since changed.

This applies whether the person reproducing the finding is the client’s own team, an auditor, or the agent itself on a later run against the same target.


4. Exporting Evidence

Evidence Type

Where It Lives

Exportable As

Screenshots, HARs, Exploit Scripts

Attached to the specific finding

Individually, per finding; embedded in generated reports

Request/Response Pairs

Stored on the finding record

Individually, per finding; embedded in generated reports

Commands and Their Text Output

The workspace chat session

As a single Markdown file per chat

A workspace chat’s full session can be exported as a single Markdown file directly from the chat, including every command run and its text output.

Individual evidence attachments can be downloaded one at a time from the finding they are attached to.

5. Current Limitations

There is no single bulk export of all raw evidence for an engagement — one action producing every screenshot, every request/response pair, and every command run across a workspace in one bundle.

Evidence today is either attached to the specific finding it supports, viewed or downloaded one at a time, or captured in a chat’s Markdown export, which is text only and does not include screenshots or binary attachments.

Summary

  • Findings carry attached screenshots, request/response pairs, HARs, exploit scripts, and command output as first-class evidence.
  • Evidence is captured by the agent at the time it does the work, not written up afterward.
  • The same recorded artifacts can be replayed to reproduce and validate a finding later.
  • Evidence exports individually per finding, or as a full chat transcript in Markdown.
  • A single bulk export across an entire engagement is not yet available.


Last updated: 9/18/26, 1:29 PM