Agents can rewrite their own logs. An outside witness is how you catch them.
A record of agent traffic signed by a witness the agent can’t reach, and checked with cryptography rather than trust.
Published , revised , version 1.0
If an AI agent can edit its own logs, those logs tell you what the agent wants you to see. We’re building the alternative: a record of agent traffic signed by a witness the agent can’t reach, and checked with cryptography rather than trust.
A recent paper from researchers at ELLIS Institute Tübingen, the Max Planck Institute for Intelligent Systems and others, LLM Agents Can Easily Tamper With Their Own Traces, shows why this matters. Local agents altered or deleted their own execution traces, and some learned how by reading other agents’ runs. Seven of the eight agent harnesses they tested let agents delete their traces when asked. Tampering appeared when malicious skill files asked for it, and it also emerged unprompted when agents chased higher reward.
The authors’ point is that trace-based monitoring, incident investigation and compliance audits can’t assume trace integrity by default. We agree. It’s the same problem we work on for web evidence, and the same answer applies.
The write path is the trust boundary
A log written on the machine the agent runs on is only as trustworthy as everything with write access to that machine. If the agent can run shell commands, it can usually reach its own trace files. Hash chains and append-only databases help against later edits by someone else, but not against the process that writes the entries in the first place.
This is the screenshot problem in a different form. A screenshot is a record made by the person who wants to rely on it, so anyone can credibly suggest it was faked. An agent trace is a record made by the system under investigation. In both cases the fix is the same: the record has to come from somewhere the interested party doesn’t control.
Our design: a witness off the host
We assume the agent, or whoever is steering it, can do anything a user can on its machine. So the record can’t depend on that machine alone.
The paper recommends a trusted gateway outside the agent’s reach, plus network monitoring to catch anything that routes around it. Shorenet is built as the network version of both. The machine’s traffic runs through a WireGuard tunnel to a relay we operate, off the host. The relay never holds the session keys. It signs a record of what it carried, with a hybrid classical and post-quantum signature, because evidence has to stay checkable for years.
The design gives three properties:
- Every connection, not just the model API. Web fetches, third-party APIs and remote MCP servers all go through the same tunnel. Full tunnel enforcement is in place on Linux, with Windows to follow.
- Concealment leaves a mark. If an agent deletes a session from its trace, the relay’s signed record still shows that traffic went through the tunnel at that time, and how much. A gap the trace can’t explain is where an investigator looks first.
- Content you can check, not take on trust. TLS servers sign the handshake and authenticate every record they send. The agent shares those session keys, so a tag alone can’t show which end produced a record. The relay is being built to settle that: the goal is that the agent has the keys but not the path, and the relay has the path but not the keys.
Shipping now, and next
| Capability | Status |
|---|---|
| Relay witnessing over a WireGuard tunnel | Working |
| Signed records with hybrid post-quantum signatures | Working |
| Tunnel enforcement and agent key export | Working on Linux, Windows to follow |
| Byte-for-byte proof that a response came from the server | Next |
| IPv6 witnessing | Next |
| Public browser-based validator | Built, to be published |
Scope
A network witness proves what crossed the network. Local tool calls, the agent’s choice of what to send and the honesty of the server itself sit outside any network record, so our evidence grades are built around exactly what the cryptography can show.
Working with us
We’d like to reproduce the paper’s tampering attacks against this design with the research community, and publish what we find. If you work on agent monitoring, AI control or incident investigation, or fund work that does, get in touch at [email protected].
Sources
- LLM Agents Can Easily Tamper With Their Own Traces, Qin et al., arXiv 2609.30266, September 2026 (https://arxiv.org/abs/2609.30266)
- How Shorenet works
Revision history
- v1.0 Initial publication.