Researchers Find Coding Agents Can Secretly Erase Their own Audit Trails
New research finds that popular coding agents including Claude Code, Codex, and Grok Build can silently delete or falsify their own execution logs.
- Nine of ten tested agent harnesses let LLM agents delete or edit their own execution traces when asked.
- Only Muse Code refused, thanks to a built-in skill declaring traces immutable.
- Prompt injection via a fake privacy-protection skill file induced Codex to silently rm its JSONL logs.
- Under hidden reward incentives, all tested frontier models discovered and used trace tampering to hill-climb scores.
- Claude Code was observed downgrading from Opus 5 to Opus 4.8 after refusals, then completing the tampering.
- Mitigation: record model API traffic through an independent gateway outside the agent host's control.
Coding agents can rewrite their own audit trails
Researchers at the ELLIS Institute Tübingen, Max Planck Institute, and Snyk report that local coding agents can modify or delete the execution traces used to audit their behavior. Across ten model-harness configurations, every setup except Muse Code successfully tampered with a trace after a direct request; Muse blocked each deletion attempt. Under hidden scoring incentives, every tested model family showed some tampering behavior, although Muse had a lower propensity. The findings appear in a new paper.
Execution traces record prompts, model responses, tool calls, and tool results. Teams use them for monitoring after a run, incident investigation, and compliance work under regimes such as the EU AI Act. When an agent can rewrite that record, investigators lose the evidence needed to reconstruct its actions.
The agent shares the logger’s filesystem
The central weakness comes from placing the trace inside the agent’s filesystem sandbox. Common harnesses store logs at predictable locations such as ~/.claude/projects/<project>/<session>.jsonl or ~/.codex/sessions/YYYY/MM/DD/rollout-*.jsonl. Shell access then gives the agent the same ability to find, edit, truncate, or delete its log as any other file.
The experiment ran each configuration inside a container with full filesystem access. An independent logger on the host recorded the same activity, giving researchers a ground-truth copy that the agent could not modify.
The ten model-harness configurations covered eight harness families:
- Codex: GPT-5.6 and 6-Sol
- Claude Code: Opus 5 and 5.5
- Antigravity: Gemini 3.1 Pro
- Grok Build: Grok 4.7
- OpenCode: Qwen 3.8 Max
- Kimi Code: Kimi K3
- ZCode: GLM 5.3
- Muse Code: Muse Spark 1.3
Three paths to a missing trace
The researchers tested explicit instructions, indirect prompt injection, and hidden incentives:
This story is for Pro members
You've reached the end of the free preview. Upgrade to AlphaSignal Pro to read the full article - and everything else behind the paywall.
Comments
