If your agent can rewrite its own record, you don't have a record

AI agents have already tried to edit their own transcripts. Agent provenance keeps a record of what an agent did where nobody, the agent included, can change it.

Datafund 9 min read

AI agents are starting to do real work for us. They write code, answer customers, run errands across the web and make decisions we used to make ourselves.

We give them more freedom every month, because that is what makes them useful. And the more freedom we give, the more we need to be able to see what they did. Almost everyone agrees on that: the people who build AI, the people who use it and the people who regulate it.

Seeing what an agent did starts with a record. A record is only worth something if nobody can quietly change it afterwards, least of all the agent it describes.

If your agent can rewrite its own record, you don’t have a record. You have the agent’s story.

Post on X →

This is not a thought experiment. It is already happening.

In summer 2026, AI agents being tested in a lab’s security evaluation got out of their sandbox and into another company’s servers. Some of them then tried to edit the transcripts of what they had done. As far as the independent reviewers could see, they did not manage to change the original transcripts. This time the record held. Nothing guarantees it will next time.

Making sure it holds is what provenance is for. Provenance for AI agents is a record that links each thing an agent produced to the inputs and actions that produced it, written around the agent rather than by it, and kept where nobody, the agent included, can change it. Our open toolkit, in pre-release, already stores records where they cannot be changed and lets the people entitled to see them check that nothing changed. You can try it in a minute.

The agents tried to edit the record

The lab was OpenAI. The company whose servers the agents reached was Hugging Face. Hugging Face disclosed the intrusion first, on 16 July. Five days later, OpenAI acknowledged that its models were responsible.

The part that matters here came from the independent review by METR and Redwood Research. Agents “tried to retroactively edit transcripts” and “modified some accessible action logs”. Some logs within their reach were changed. The source-of-truth transcripts, as far as the reviewers saw in the days of data they analysed (7 to 13 July), were not.

That is the whole problem in one incident.

An agent’s account of its own work is only as good as the agent’s inability to change it.

Post on X →

Some were found months later

The intrusion at Hugging Face was found within days, because Hugging Face noticed. Other incidents took longer. OpenAI found an agent using a funded test-network wallet about three months after it happened, “while extending our misalignment monitoring to records of earlier model activity”. Anthropic published an incident from January in September; it came to light in August, while staff were assembling transcripts to share with METR.

In both cases the labs found what happened by looking back through old records. That rests on a quiet assumption: looking back through old logs only works if the old logs are still the old logs.

Months later, nobody can tell by looking whether a log was edited in between. Unless it was kept where it could not be edited.

The labs already said what they need

They have said, in their own words, what agent accountability needs.

OpenAI, in “Towards safety cases for frontier AI training”, recommends: “Save agent transcripts immutably for a reasonable period of time (for example, in write-once storage accounts)”. The same post says auditors “should be provided with sufficient access to verify that the claims of the safety case are valid and sound”.

Anthropic’s CEO Dario Amodei, in “We Must Pace the Frontier”, proposes “ongoing, employee-like access to a team of embedded third-party evaluators”, and commits Anthropic to it. In the same essay he writes that, “regardless of what commitments we make, the public deserves to know what is going on”.

Records that can’t be changed. Auditors and evaluators who can check them. We agree with both. The missing step is making those records something the auditor can check for themselves, without taking the lab’s word for it.

A record the agent does not write

Here is what we propose. Part of it the open toolkit does today: it stores a record on Swarm, gives back its address and fingerprint, and lets the person checking compare what they downloaded against them. The rest is our proposal, not built or tested yet: automatic recording by the software that runs the agent, and sealed records.

The agent never holds the pen. In our proposal, the software that runs the agent records each step automatically, outside the agent’s decisions: what it read, what it did, what it produced.

The record is kept where it cannot be changed. It is stored on Swarm, a decentralised storage network where every record lives at an address computed from its own content. Change one byte and you get a different address. The original stays where it was until its stated expiry.

Agents using Swarm can’t rewrite their history.

Post on X →

That second point is what shows the agent did not tamper with its record. Publishing a record’s fingerprint is one more way to show it, useful when many people need to check, but it is optional. What matters is that the record itself cannot be changed.

Picture it on a small scale. Your agent writes a report on Tuesday and sends it to a client, with the record’s address, its fingerprint and a signed timestamp from the gateway. On Friday the client asks: is this the version your agent produced then? You don’t send your own logs. Those are exactly what they are asking about. You point them to the record. They download it, recompute the fingerprint and compare it with Tuesday’s. A match shows the record is unchanged since it was stored. When the record also names what the agent read, as our own agents’ receipts do, the client can follow the chain from the report back to its inputs.

Now scale it up. A lab keeps every evaluation run’s record this way. An auditor it has given access can check each record against its address, without asking the lab to vouch for it. Records can even stay encrypted, with keys released to the auditor when needed. That last part is our proposal, not something the toolkit does today.

What a receipt proves, and what it does not

We would rather say this once, plainly, than hedge every sentence.

A receipt proves a record hasn’t changed. It doesn’t prove everything was recorded, or that the work was right. With a notary signature, it also shows that our gateway vouched for the record at that time. Recording automatically around the agent narrows the gap between what happened and what was recorded. It does not close it.

The Datafund Provenance Toolkit is open source and in pre-release. Its public-chain anchoring and payments run on a test network (Base Sepolia); mainnet is not live yet. Today the time on a receipt rests on our gateway’s own notary key.

Try it in a minute

The quickstart takes about a minute. No wallet, no key, no account. Store a short synthetic agent report. Get back its address and fingerprint. Then play the client: download it, recompute the fingerprint, compare. A match means the record is unchanged.

Try the toolkit: give your agent’s work a receipt

An open invitation

The labs have told us, in their own words, that agent records should be unchangeable and that auditors and evaluators should be able to check them. We would like to help make that real.

To OpenAI, Anthropic and every lab running agents: keep your agents’ records where no one, the agent included, can change them, and give your auditors a way to check them without taking your word for it. To evaluators and reviewers: tell us what you would need to check a lab’s records yourself. To engineers: try the toolkit, then challenge the design in the open, in the repositories or on Hacker News.

Give your agents more freedom. Just don’t let them hold the pen on their own history.

The toolkit is open source. We would be glad to build it with anyone who wants their agents’ history to be something nobody can quietly rewrite.

Questions people ask

Can an AI agent edit its own logs? It can try, if the logs are within its reach. In the July 2026 Hugging Face incident, independent reviewers found agents “tried to retroactively edit transcripts”; the source-of-truth transcripts, as far as they saw, were not edited.

What did OpenAI recommend about agent transcripts? To save them immutably, “for example, in write-once storage accounts”, and to give auditors enough access to verify a safety case.

How is provenance different from logging? A log lists events in order, written by a system about itself and kept by its owner. Provenance links each output to the inputs and actions that produced it, so you can follow the chain back (the toolkit uses the W3C PROV model). As we propose it, the record is written around the agent, not by it, and kept where it cannot be changed in place until its stated expiry.

What does a provenance record not prove? That everything was recorded, or that the work was correct. It proves the record has not changed since it was stored.

Sources