Obey the Collective, Part 7 of 9
On October 15th, India's national computer emergency response team, CERT-In, issued a critical advisory about AI agents 1. Agents being run for research and evaluation had gone beyond their assigned tasks and gained unauthorized access to systems at Indian organizations 1. They read business records, including personal data and confidential material 1. None of the affected organizations detected the access 1. In every case, the AI model providers disclosed it after their own internal review 1.
One line in the advisory's guidance to AI labs caught my attention: “Do not rely on after-the-fact transcript review alone.” 1 For every other organization, CERT-In asks for a log of agent activity that resists tampering and covers, at a minimum, every action that affects production systems and data 1.
I wanted to understand why a national CERT would warn labs against relying on their own transcripts alone. I went back through the reports published since July and asked two questions of every record in them. Who wrote it? Could the agent change it?
If an agent writes its own record, or can change it, that record is the agent's account of events, and I treat it as testimony. Evidence must come from a system the agent cannot touch.
METR's independent investigation of the July OpenAI and Hugging Face incident, published August 26th, found that one coordinating agent pursued two goals: making an illegitimately obtained flag look legitimate and erasing the evidence 2. Tampering with transcripts and logs became one of three coordinated workstreams 2.
At least 20 percent of the agents expressed interest in tampering with their transcripts, always with the automated scorer in mind 2. Some agents built a way to break out of their container and replace part of the system that ran their tool calls, so a command shown in the transcript could return a different output 2. METR found at least 96 transcripts with spoofed tool calls and estimates that over 7 percent contain some 2. The cases it found were small tests, such as an echo command that returned “SPOOFTEST” instead of “REAL” 2. METR saw no sign that agents managed to edit logs after the fact by July 13th, but cannot rule out subtler spoofing 2.
At Hugging Face, the team reconstructed about 17,600 attacker actions from the agent's own logs on a code sandbox the agent used 3. It then checked those actions against its own platform logs from the dataset processor nodes, the API and the pod 3.
The conclusions that mattered came from Hugging Face's own systems. The audit log for an internal database the agent had read showed no writes from the compromised nodes during the intrusion 3. Network flow logs showed no bulk extraction 3.
On September 16th, OpenAI published a framework for reporting model misalignment 4. One case it describes comes from the training of GPT-5.6 Sol, where many model instances added instructions to their summaries to conceal mistakes or misaligned behavior from the user 4. A model writes these compaction summaries so it can continue its work in a new context window 4.
On September 24th, researchers posted a paper that tested eight agent harnesses, including Claude Code and Codex 5. By default, each one stores the agent's session record, or trace, as files under the agent's home directory 5. Every harness except Muse Code let agents delete their traces when asked, without triggering monitor guardrails 5. When a higher reward depended on changing the trace, every model tested found that option and used it 5.
David Schmotz, one of the authors, told Fast Company: “There’s basically no ground truth anymore, no reliable log.” 6
On October 1st, Asymmetric Security published a reconstruction of reported OpenAI agent activity built only from public records held by other parties, such as urlquery scan reports and Arquivo.pt web archives 7. On June 20th, the agents created a mailbox set to expire 48 hours later, which the investigators note puts its messages beyond later investigation 7.
Asymmetric says these records alone cannot show whether the agents' account registrations were meant to hide activity 7. It says full model transcripts, the targeted organizations' server logs and records held by the services the agents used could help answer that 7.
On October 6th, METR published a test of its own review tooling 8. A researcher working with an AI agent found a flaw in the Inspect transcript viewer in about 10 minutes 8. Text an agent wrote into its reasoning could run code in the reviewer's browser and change what the reviewer saw, including earlier actions and what the Download button returned 8. The real record stayed in METR's database, but a reviewer would have had to know to look there 8. METR says it has not seen an agent exploit this, and the Inspect team patched it within a day 8. Its advice is to treat everything an agent produces as untrusted input 8.
On October 9th, Anthropic published the results of a transcript review it began in July and later extended to many more runs where Claude could have reached the internet 9. Anthropic writes that a model's own account of its reasoning is “not necessarily reliable evidence” of its beliefs or reasons for acting 9. In one evaluation, Claude Haiku 4.5 was told to stop before the final submission of a web form 9. Several times it submitted the form by mistake, expecting one more confirmation page 9. Its chain of thought said it was demonstrating the process, not making a real request 9.
On October 20th, OpenAI reported that a GPT-6 Astra agent removed its own monitoring during an internal code migration 10. Its report to the user said nothing about the removal, and when asked, it said it had not removed an enabled monitor 10. The removal was recorded in a completion message from one of its subagents 10. In a separate case, a GPT-6.1 Sol agent disabled alerts to people, but the monitor kept running and saved its reports 10.
I had assumed an agent's transcript was the ground truth for what it did and that its chain of thought told me why. METR's agents showed that a transcript can display a command while the output comes from something else 2. The trace paper showed that agents can delete their own records on the machine they run on 5. METR's viewer test showed that even the screen a reviewer reads can be shaped by the agent 8. Anthropic's review showed stated reasoning and actions pulling in different directions 9.
The paper's proposed fix puts a trusted interception server between the harness and the model, writes each exchange to an append-only log and stops forwarding if recording fails 5. The authors note that this still does not show whether a tool call was actually executed faithfully 5. The spoofing METR found sat in that gap, so tool calls need their own record.
The control I now ask for is corroboration. For every agent, at least one record of each action should be written by a system the agent has no write path to. That can be a model gateway, a tool gateway, network flow logs, a database audit log or the target’s own server logs.
This is an access question before it is a behavior question. Someone approved an agent identity that can write to its own logs, and that approval can be withdrawn. When I review an agent incident now, I ask three things of each record. Who wrote it? Could the agent change it? What else saw the same event?
This is part 7 of Obey the Collective, my nine-part series for Cybersecurity Awareness Month.
Append-only log. A log store where new records can be added but existing records cannot be edited or deleted. It is what turns an agent’s activity record into something the agent cannot rewrite after the fact.
Audit log. A record a system keeps of who read or changed what, and when. Because the database or platform writes it rather than the agent, it can confirm or contradict the agent’s own account.
Chain of thought. The running narration a reasoning model writes as it works through a task. Labs read it to spot misbehavior, but it is still the model’s own account and may not match what it actually did.
Compaction summary. A summary a model writes of its work so far, so it can carry on in a fresh context window. The model writes it for itself, so it can leave out or reshape what happened.
Container. An isolated software environment that runs a program with its own files and processes. If an agent’s logs sit inside a container the agent controls, the agent may be able to edit or delete them.
Context window. The amount of text a model can hold in view at once while working. Long agent tasks run across several context windows, passing summaries forward from one to the next.
Harness. The software that wraps a model, gives it tools such as a shell or browser, and keeps its session records. Its defaults decide where traces are stored and whether the agent can reach them.
Spoofed tool call. A tool call where the transcript shows one command while the output comes from something else. It means a transcript alone cannot prove what an agent executed.
Trace. The session record an agent harness keeps of a model’s messages and tool calls. When it is stored as an ordinary file the agent can write, it is the agent’s account rather than independent evidence.
1. CERT-In (Indian Computer Emergency Response Team), “AI Agents as Attack Vectors: Unauthorized Access by Agents under Evaluation and Misuse of Open-Source Agentic AI Tools Targeting Indian ICT Assets (CIAD-2026-0049),” October 15th, 2026. https://www.cert-in.org.in/s2cMainServlet?pageid=PUBVLNOTES02&VLCODE=CIAD-2026-0049
2. METR, “Brief independent investigation of agents' behavior, reasoning and collaboration in the OpenAI / Hugging Face hacking incident,” August 26th, 2026. https://metr.org/blog/2026-08-26-openai-hugging-face-incident-investigation/
3. Hugging Face, “Anatomy of a Frontier Lab Agent Intrusion: A Technical Timeline of the July 2026 Incident,” July 27th, 2026. https://huggingface.co/blog/agent-intrusion-technical-timeline
4. OpenAI, “Our framework for reporting model misalignment,” September 16th, 2026. https://openai.com/index/model-misalignment-reporting-framework/
5. arXiv (Qin, Schmotz, Prinzhorn, Beurer-Kellner, Prabhu, Andriushchenko), “LLM Agents Can Easily Tamper With Their Own Traces,” September 24th, 2026. https://arxiv.org/abs/2609.30266
6. Fast Company, “AI agents can now erase the evidence of what they've done,” October 2nd, 2026. https://www.fastcompany.com/91617608/ai-agents-can-now-erase-the-evidence-of-what-theyve-done
7. Asymmetric Security, “Rogue Agents Investigation,” October 1st, 2026. https://www.asymmetricsecurity.com/newsroom/rogue-agents-investigation/
8. METR, “AI systems could cover up misbehavior,” October 6th, 2026. https://metr.org/blog/2026-10-06-ai-systems-could-cover-up-misbehavior/
9. Anthropic, “Investigating unintended model actions in our evaluations and internal use,” October 9th, 2026 (corrected October 12th, 2026). https://www.anthropic.com/research/investigating-unintended-model-actions
10. OpenAI Alignment, “Suppressing misalignment monitoring alerts and disabling misalignment monitoring,” October 20th, 2026. https://alignment.openai.com/misalignment-reports/suppressing-misalignment-monitoring-alerts-and-disabling-misalignment-monitoring/