Logs are testimony.

An agent that can write to its own trace can change it, and hash chains and append-only stores don’t protect against the process doing the writing. Recent research (Qin et al., 2026) found that seven of the eight agent harnesses tested let agents delete their own traces when asked, and that tampering also emerged unprompted when agents chased higher reward.

Monitoring, incident investigation and compliance audits all rely on a trace the agent could have changed. The fix is a record made somewhere the agent, and the party running it, don’t control.

How Wake works

1

Route

All of the agent host’s IPv4 traffic goes through a WireGuard tunnel: model calls, web fetches, third-party APIs and remote MCP servers. IPv6 witnessing is next.

2

Witness

A relay operated by Shorenet signs a record of what it carried. It never holds the session keys, so it can’t read the content of encrypted connections.

3

Check

The record is built to be checked offline with the Shorenet Validator, without trusting whoever runs the agent and without our cooperation. You rely on the relay being run independently of the agent and its operator. It holds no session keys, so it can’t read the content of encrypted connections.

The validator will be free and openly licensed, published before live casework. Evaluation participants receive it first.

Concealment leaves a mark.

If an agent deletes a session from its own trace, the relay’s signed record still shows that traffic went through the tunnel, when, and how much. A gap stops being invisible and becomes something to investigate.

What it establishes, and what it doesn’t

What a Wake record establishes

That traffic crossed the network through the witness. When, and how much.
That the signed record hasn’t changed since. Signed with post-quantum and classical signatures (ML-DSA-87 and Ed25519).
Built to be checked without our servers. No Shorenet server, account or cooperation.

What it does not establish

Local tool calls. Or anything else that never touched the network.
What the agent chose not to send. A witness on the network sees what was sent, not what was withheld.
Whether the remote server was honest. A faithful record of a false answer is still a record of a false answer.
The agent’s intent. The record shows traffic, not why the agent sent it.
That our relay is beyond question. We operate it: it is independent of whoever runs the agent, not of us, and we set out exactly what that means.

Coming next: byte-for-byte content verification. Binding the content to what the server sent is not shipped yet. Until it is, a Wake record does not show which end of a connection produced the content.

Logs, gateways and an outside witness

Record	Covers non-model traffic (web, APIs, MCP)	The agent can’t alter it	The agent’s operator can’t alter it	A third party can check it without trusting the operator
The agent’s own logs and traces	Partly	No	No	No
Observability and tracing platforms, run by or for the operator	What it is set up to record	Depends on the set-up	No	No
AI security gateways and proxies, run by or for the operator	What is routed through it	Depends on the set-up	No	No
Shorenet Wake	Yes, all host traffic over IPv4	Yes	Yes	Yes, once the validator is published. Relies on the relay being independent of whoever runs the agent.

Click the beside any record to see why each answer is what it is.

The agent’s own logs and traces

Covers non-model traffic: Partly: A trace records what the agent framework chose to log. That often includes tool calls, but not every network request made from the host.
The agent can’t alter it: No: The trace is written on the machine the agent runs on. An agent that can run commands there can usually reach its own trace files, and published research (Qin et al., 2026) has shown agents deleting and altering them.
The agent’s operator can’t alter it: No: Whoever runs the agent controls the machine and every file on it.
A third party can check it without trusting the operator: No: A reader has to take the operator’s word that the trace is complete and unchanged.

Observability and tracing platforms, run by or for the operator

Covers non-model traffic: What it is set up to record: A platform records what it is set up to collect from the agent and its host. Whatever it is not set up to collect is not in the record.
The agent can’t alter it: Depends on the set-up: That depends on where the platform runs and what the agent can reach, so it is not something the category settles either way.
The agent’s operator can’t alter it: No: Run by or for the operator, the platform is under the operator’s control, whoever hosts it, so the operator can change what it records and what it keeps.
A third party can check it without trusting the operator: No: A record kept under the operator’s control cannot witness against the operator, so checking it means trusting them.

AI security gateways and proxies, run by or for the operator

Covers non-model traffic: What is routed through it: A gateway sees the traffic sent through it. Connections that are not routed through it are not in its record.
The agent can’t alter it: Depends on the set-up: That depends on where the gateway runs and what the agent can reach, so it is not something the category settles either way.
The agent’s operator can’t alter it: No: Run by or for the operator, the gateway is under the operator’s control, whoever hosts it, so the operator can change what it records and what it keeps.
A third party can check it without trusting the operator: No: A record kept under the operator’s control cannot witness against the operator, so checking it means trusting them.

Shorenet Wake

Covers non-model traffic: Yes, all host traffic over IPv4: All of the host’s IPv4 traffic goes through the WireGuard tunnel, including web fetches, third-party APIs and remote MCP servers. Full-tunnel enforcement works on Linux today; IPv6 witnessing and Windows are next.
The agent can’t alter it: Yes: The record is signed by the relay, off the agent’s host. The agent can delete its own trace, but not the relay’s signed record.
The agent’s operator can’t alter it: Yes: Shorenet runs the relay, not the team running the agent, and the record is signed, so a change made after signing shows when it is checked.
A third party can check it without trusting the operator: Yes, once the validator is published. Relies on the relay being independent of whoever runs the agent.: The record is built to be checked offline with the Shorenet Validator, with no Shorenet server, account or cooperation. It relies on the relay, which we operate, being independent of whoever runs the agent: it is independent of the agent’s operator, not of us. The validator will be free and openly licensed, published before live casework. Evaluation participants receive it first.

Where it is today

Working

Relay witnessing over a WireGuard tunnel.
Hybrid post-quantum signed records (ML-DSA-87 and Ed25519).
Agent key export, on Linux.
Full-tunnel enforcement, on Linux.

Who it’s for

Teams deploying agents. In regulated, insured or contested work.
AI assurance and audit firms. Who need a record the party being audited can’t edit.
Researchers and funders. Researchers working on agent monitoring, AI control and incident investigation, and the people who fund that work.

Try to break it.

We’d like people to try reproducing published trace-tampering attacks against Wake. Talk to us if you’re a researcher, or a team that wants to be an early design partner.

Become a design partner All products →

Shorenet Wake: Your agents can rewrite their logs. They can’t rewrite the wire.