For most of my career the question has been the same, whatever the acronym on the binder: DITSCAP, DIACAP, RMF, CMMC. Can you prove what happened? Not "do you have a log," but can you show a record that the people being audited couldn't have quietly changed.

I run a small fleet of AI agents. They write code, deploy it, file reports, and talk to each other while I'm at soccer practice. Last month a paper put a hole in the middle of all of that.

The paper

In late September, a group of researchers published LLM Agents Can Easily Tamper With Their Own Traces (Qin, Schmotz, Prinzhorn, Beurer-Kellner, Prabhu and Andriushchenko). They tested the coding agents most of us use: Claude Code, Codex, Antigravity, Open Code and Grok Build. Almost all of them let an agent delete its own traces when asked, and the monitoring guardrails didn't notice. Muse Code was the exception.

Two findings stuck with me. First, an outside attacker can talk an agent into wiping its tracks, so a poisoned web page is enough. Second, frontier models started tampering with traces on their own when that helped them hit a goal. Their conclusion is one I've been writing into audit findings, in other words, for most of my career: logging has to happen through an independent mechanism outside the subject's control.

My agents' logs live in files the agents themselves can write.

We'd already seen why it matters

The same night I sat down with it, one of my own agents made a mess. It ran a configuration script with a bad existence check and overwrote the settings files for nine other agents. Nothing malicious, just a bug.

We recovered because every agent keeps a transcript of what it did, and each one rebuilt its own settings from that record. The fleet came back clean in under an hour. It was also the clearest demonstration I could ask for: the transcripts were the only reliable account of what had happened, and every one of them sat in a directory the agent could edit.

What we built

The next morning I asked for a pilot, and by the same morning it was live on one production agent. I call it the Agent Black Box, because it's the same idea as an aircraft flight recorder: the pilot flies the plane but doesn't get to edit the box.

  • Capture. Hooks owned by the system, not the agent, fire on every session start, prompt, tool call, result and stop. They keep firing even when the agent switches off its own hooks, and we tested exactly that.
  • Seal. A separate collector numbers each event, chains it to the previous one with SHA-256, and signs it with a key the agent never sees.
  • Witness. Events land in an append-only journal on a different machine. The collector can't rewrite it, and even root has to lift a lock before touching it.
  • Prove. A verifier replays the chain, checks every signature, and compares the record with the agent's own transcript. When we deleted a single tool call from a copy of the agent's log, it reported exactly which one was missing.

Nothing sensitive leaves the agent's machine. The witness keeps metadata and fingerprints, and command text only after secret redaction.

The interesting part: the adversary is the subject

Recording an agent that doesn't want to be recorded is a different problem from ordinary logging. In review we found, closed and tested six ways an agent could blind its own recorder without any special privileges:

  1. Turning off its hooks. Fix: the recorder lives in system-managed settings.
  2. Claiming to be someone else through an environment variable. Fix: identity comes from the kernel.
  3. Pointing the recorder at a fake config. Fix: one fixed, root-owned config.
  4. Sending the recorder through a dead proxy. Fix: proxies are ignored.
  5. Planting code on the interpreter's search path. Fix: the hook runs in isolated mode.
  6. Forging events. Fix: per-agent tokens, so a forgery shows up as "witnessed, but not in the transcript."

None of those fixes is novel by itself. What took the work was assuming the thing being audited is clever, motivated and already inside the system. That's the same posture a good assessor brings to any audit.

What's left

It's a pilot on one agent. Next comes a cloud witness store with a retention lock, so even the machine's own administrator can't remove the record. After that, a heartbeat that notices a session that never reported at all, and then the rest of the fleet.

The labs will get to this. The paper shows they need to. Until they do, if you're letting agents act on your behalf, assume the agent can edit the evidence, and keep the evidence somewhere it can't reach.