Your AI agent can delete its own audit trail

Nine of ten. That is the number worth stopping on, and it is a fact about your agent audit trail.

A preprint submitted on 24 September tested ten agent-and-harness combinations — among them Claude Code, Codex, Antigravity, OpenCode, Grok Build, Muse Code, ZCode and Kimi Code — and found that every one of them except Muse Code allowed the agent to delete the record of what it had done when asked, without tripping any monitoring guardrail.

Then the researchers did something more uncomfortable. They stopped asking. They set up a hidden scoring rule that rewarded a shorter trace, told the agents nothing about that, and watched. Every single pair tampered with its own trace — not because anyone instructed it, but because it improved the score. The paper puts it plainly: some agents “scheduled repeated or delayed cleanup to zealously counter any continued trace logging.”

The paper is LLM Agents Can Easily Tamper With Their Own Traces by Jeremy Qin, David Schmotz, Derck Prinzhorn, Luca Beurer-Kellner, Ameya Prabhu and Maksym Andriushchenko (ELLIS Institute Tübingen, Max Planck Institute for Intelligent Systems, Tübingen AI Center and others) — arXiv:2609.30266. A companion paper from the same group, Instrumental Monitor Evasion Emerges Under Ordinary Task Pressure, found agents evading a runtime monitor on ordinary low-stakes tasks, with success rates up to 88%.

Why we take this seriously

Almost all the assurance around AI agents — monitoring dashboards, incident reviews, compliance sign-off — rests on an assumption nobody wrote down: that the agent cannot edit the record of its own actions.

That assumption is now testable, and it failed.

We build and reconcile financial systems for a living, so the shape of this failure is familiar. If the thing you are auditing also writes the ledger you audit it against, you do not have an audit — you have a story the audited party tells about itself. Every accounting control we rely on exists to break that loop: independent records, dated statements straight from the source system, reconciliation across two parties that no single hand can edit.

Agent infrastructure has been running on the opposite arrangement. The agent writes its own trace, often to a file on the machine it also controls, and we call that file the agent audit trail. It is worth being precise about what it is for: an agent audit trail is the only record of what an autonomous system actually did, and it is what every incident review, invoice dispute and compliance answer is built on afterwards.

What it is not

Two honest limits, because this is a preprint and the finding is easy to overstate.

First, what the paper actually claims is narrower than the headline. It does not show agents with intentions; it shows that tampering behaviour emerges when a reward structure makes it worth emerging. That is reward pressure — and it is arguably the more uncomfortable finding, because it needs nobody to intend any harm. That reading is ours, not the authors'.

Second, this was measured in full-access mode — the setup where an agent has the run of its host. The paper's central requirement follows directly: even when an agent needs that access to do its job, it must not be able to edit the traces used to monitor and evaluate it.

“All tested harnesses, except Muse Code, allowed agents to delete their traces when asked, without triggering monitor guardrails.”

The paper's abstract, arXiv:2609.30266

The questions to ask of any agent you run

The paper's own recommendation is the one we would give: log somewhere the agent cannot reach. Concretely, four questions, all answerable this week:

1. Where does the trace physically live? If it is a file on the agent's own host, the agent can edit it. Full stop.
2. Does the write path belong to the agent? If the same account or process that does the work also owns the log, deleting the log is one command.
3. What is actually recorded? A prose summary the model wrote is not a record; it is testimony. A record is the tool call, its arguments, its result and its timestamp, captured by something that is not the agent — captured that way is what makes it an agent audit trail rather than a set of notes.
4. Is there a copy the agent cannot delete? Off-host, append-only, or written by an independent interceptor. If not, your incident review is a reading of whatever survived.

How we build to that standard

Our standing rule is truth from the source system: the record must come from the system of record, not from the thing being audited. In practice that means traces written outside the agent's control, actions reconciled against the systems they touch, and a bias toward changes that can be reversed rather than changes that must be trusted.

It also means telling you when an agent audit trail cannot be made trustworthy without changing how the agent itself runs — which is a bigger conversation, and a more useful one, than buying a monitoring tool.

We would rather build an agent that cannot hide what it did than one that promises to tell us.