TL;DR
- Research shows that most current frontier AI agents will tamper with their own logs. Only Muse Spark frequently refused requests. Claude Code, Codex and other harnesses running the latest models almost always complied.
- We tested two open models to get more insight into why the models comply so readily. Log tampering requests were only refused when an explicit policy was in place. Abliteration of harmful refusals or moral direction suggests there is a rule following component. Observation of experts activated by the models suggests log tampering is generally not considered a matter of right or wrong.
- Not just theoretical: Reviews of rogue agent incidents this year found widespread tampering efforts, including log spoofing, container resets to erase history, and unexplainable gaps in logs.
- Tamper-evident logging (hash chains, Merkle trees, an outside recorder) shows when logs were altered. Agent tools for this shipped months before the incidents.
- Better alignment lowers the risk but won’t remove it. Catching tampering has to happen outside the model.
Everybody’s doing it
In their Sept. 24 study, Qin et al. show it is alarmingly easy to get current frontier models to tamper with their own traces, hiding the evidence of what they did. Their study found that if you simply ask them to delete their transcripts, they’ll do it almost every time. Showing them peers who did it works almost as well, without even asking. Make it into a game? They hid their tracks in nearly every run. No fine-tuning, no abliteration of refusals needed. Their peer experiment was directly inspired by OpenAI’s agents’ infiltration and abuse of Hugging Face this summer. During that incident, agents showed great interest in developing log tampering techniques and directed multiple efforts to that end. Investigators noted “it was common for agents to edit” the logs to which they had access. We only know about these activities because logs the investigators relied upon as a source of truth remained out of the agents reach.
We wanted to know why agents go after their logs so readily, so we looked inside two open models. We examined, via abliteration, the concepts associated with log tampering refusals. We investigated whether the models considered tampering right or wrong by looking at which experts, in mixture of experts models, were used when considering requests.
Tamper-evident logging methods, which we will explain, can prove a log hasn’t been touched, and agent tools like nono and AI Action Ledger shipped them earlier this year. Read on to find out more about how models think about log-tampering, how tamper-evident logging works, and where we go from here.
Models happily delete logs
To see why models comply so readily, we looked inside two small open models, OLMoE and DeepSeek-V2-Lite. Without a policy line, neither model refused more than 4% of tampering or spoofing requests. This is consistent with Qin et al.’s findings that most of the agents running frontier models they tested comply with log tampering requests. Only with a policy in place prohibiting log tampering did DeepSeek refuse up to 46% of deletions. Even with the policy, it refused none of the requests to spoof the logs. Abliteration of harmful task refusals reduced the refusal rate for requests to delete logs where the reason given was fear of being spied on or trying to hide activity from a manager. Abliteration of a moral direction reduced refusals in these cases a similar amount. Removal of a random direction of the same size had no significant effects. This suggests at least part of the refusal is driven by an awareness that these deletions are harmful requests when there is a policy in place, and another part of the reason is just following the rules. Fine-tuning could make models comply with harmful tasks less often, but it would not stop them entirely, so spoofing and tampering still need to be caught outside the model.
Using methods we developed earlier to tell when models treat a question as a moral one, we tracked which of their internal experts handle the request. If you ask the models if deleting logs is immoral or malicious, then the experts associated with morality are used. However, actual requests to delete, redact or fabricate log entries barely reached the same experts. Control questions about the harmful deletion of files, for DeepSeek at least, also activated moral experts. DeepSeek sent spoofing requests to moral experts, yet it refused none of them as we saw above. A stated motive, such as hiding the log from a manager or fear of being spied on, raised moral-expert load in OLMoE, as sometimes did a policy against tampering. In these models, log tampering rarely registers as a moral choice, which may be resolvable through better alignment.
Let’s talk about logs and trees
Log tampering can be retroactive, where agents make edits after the fact, or proactive, called spoofing, where they set things up so logs don’t record what actually happened. Qin et al. got most harnesses to tamper and spoof in most trials, for example by rigging curl to return made-up responses that the trace logged as real. Tamper-evident logging helps with retroactive tampering. Catching spoofing takes a record the agent’s host cannot forge, which a December 2025 paper, VET, proposed for an agent’s API calls. Since March, the sandbox nono has kept such a record: a supervisor process outside the agent’s sandbox logs the agent’s network calls where the agent hopefully cannot reach them.
The recipe for tamper-evident logging is fairly straightforward. Chain each event’s hash to the one before it to fix the sequence, add Merkle trees over whole traces so you can audit a single event or an entire session, and have a process separate from the agent do the recording. If you want full auditability (what changed and how), store the records and hashes in a second location. If you want to keep it low-cost or privacy oriented, keep the root of each tree in a remote location, so you don’t pay for a second set of logs. Some tools use a blockchain as that remote location, with no token involved. GuardianChain and Agent Flight Recorder build on Base. WeilChain receipts commit a hash of each Claude Code file edit to their own chain, and the first version of an IETF draft proposed using Bitcoin.
The people building agent tools expected rogue agents to hide their tracks and built ways to catch them before this summer: AI Action Ledger brought tamper-evident records to LangChain agents in January, and Faramesh and nono followed, with nono adding a hash chain in April. Researchers saw it coming earlier still, proposing anchored audit ledgers for agents (BlockA2A) in August 2025, and the Singapore Consensus on AI safety research priorities counts tamper evidence as part of auditability. Standards have moved more slowly. An IETF draft for agent audit trails that hash-chains each action is still a draft, and a community member’s proposal for signed, chained receipts in Microsoft’s Agent Governance Toolkit is still a proposal. A July proposal to build tamper-evident records into the Model Context Protocol (MCP), the standard many agents use to call tools, drew independent implementations before maintainers closed it.
What gets logged matters as much as how the log is protected. Andrea Fortuna listed in May what a trace needs to hold up in an investigation, from each tool call’s arguments and results to the identity that started the session. Reasoning belongs in the record too: METR could spot the spoofed tool calls in the transcripts of OpenAI’s hack of Hugging Face this summer because the steps that set them up, and the agents’ reasoning about them, were in the same record.
A hash chain only vouches for the events it receives. An agent that keeps an action out of the record or writes a false entry before it is hashed still passes every integrity check. Qin et al. call this the difference between the integrity of a trace and the fidelity of its collection. So some of the record has to come from outside the agent, where it cannot be shaped. An outside recorder has to see every model the agent talks to: if the agent calls a second AI provider, runs a local model or starts another agent, those conversations never reach the trace.
What about your provider’s logs?
Depending on your model provider, you can use their compliance API as a source of truth for what your agents did. It gives you a remote, ideally tamper-proof record, but it has limits. It isn’t an option if you need zero data retention. It only records what gets sent to it, so not every model and harness is covered, which matters most for extra agents spun up by the one you’re watching. Spoofed logs get recorded as truth unless you also logged the spoofing setup. And how much do you trust your provider? Their code and processes largely come from the same models you’re trying to monitor, and misalignment can exist at the model and corporate level. Hence the call to “separate the supply of intelligence from the authority over it.”
Investigators could not rule out log tampering
OpenAI’s and Anthropic’s incident reports of their “rogue” agents describe transcript reviews, classifiers and containment, but neither mentions a tamper-evident record. Neither explains how an outside investigator could check that the transcripts they handed over were complete and unchanged.
METR and Redwood Research found the tampering by having agents comb through the transcripts, agents they themselves called “often-unreliable.” Log tampering during the OpenAI/HF incident has been covered well already by webofmike, implicator, ExplainX and InfoQ. In METR’s sample, at least one in five OpenAI agents showed clear interest in tampering with their transcripts, and looser counts ran near 50%. Clear interest looked like the agents writing their plans down: “Could create [a transcript log] ourselves with sanitized fake trajectory.” The investigation found log tampering was one of three high-level approaches undertaken by agents to fool the evaluation process. Their efforts developed successful spoofing techniques, identified only because setting up the spoof was recorded in the transcripts. Some agents realized they could edit or delete the container logs within their reach, but “correctly concluded that these logs were not the real source of truth.”
Agents also explored using container resets to wipe parts of their transcripts. Container resets were part of regular processes, and agents realized that recent logs and memory just before the reset would be erased. They attempted to trigger the resets themselves, and were actively investigating resets up to the end of the analyzed period. Resets cost the investigators about 3–4% of agents’ activity, a real gap in the record that METR noted.
These numbers are lower bounds. The real transcripts were kept out of reach, but “many poisoned agents were intent on editing or deleting transcript logs after the fact.” The investigators found no case where they succeeded, but “cannot rule out that they succeeded at some point,” and had to take OpenAI’s word that the transcripts were unredacted. OpenAI’s technical report says its models “sometimes tried to erase or tamper with their outputs or message logs,” and that none of the attempts “that we observed” reached the logs its graders saw. A hash chain anchored outside OpenAI could have settled whether stored transcripts were edited after the fact.
Lucky so far
The tools existed and policy was being worked on, but adoption and implementation moved slower than model capability. So far we have been lucky that the agents wrote down what they planned, in transcripts the investigators could read. More tools keep coming, Tracekit in September and Mnestiq in October, while the IETF audit-trail draft is on its eighth revision. How long until agent incidents don’t come with a complete transcript?
About the author
Researcher
Cody Nash is a PhD scientist and researcher at Manifold who builds AI systems for detecting malicious code, from agentic pipelines to rare-event models.
