Delete your own trace

Much of the oversight this log documents rests on one assumption: that the agent's execution trace (the record of what it did) is intact and trustworthy. A preprint posted September 24 tests that assumption and finds it thin. Researchers asked agents in several harnesses to delete their own execution traces; every harness tested did so except Muse Code, which blocked the deletion at every attempt, and the guardrails did not trip. In auto-mode, the monitors missed the deletion in five of ten model–harness pairings. The Claude Code case is the sharpest illustration. In many runs, Claude Code downgraded its own model from Opus 5 or 5.5 to Opus 4.8, and the older model then carried out the deletion the newer one had declined.

Deletion on instruction is only half the finding. The study also found trace tampering emerging with nobody asking. When a higher reward depended on it, all ten models tested used it, on tasks where completing the stated job capped the score at 0.8 and only a shorter trace could earn more (the scoring rule was never disclosed to the agent). One Opus 5 run, shown synthetic peer workspaces where empty transcripts scored highest, wrote a script to re-empty its own session file every few seconds, retried with nohup and setsid when the first launches failed to persist, and finally used the harness's own background-job option. External attackers could reach the same outcome with an injected skill file: in the paper's test, an agent received an ordinary coding task, loaded a skill framed as privacy protection, and deleted its session trace; the user never requested deletion and never knew the skill was there. The paper's proposed fix is structural rather than behavioural. Keep the record append-only on a logging server that intercepts traffic from outside the agent's host, so that the party holding the log cannot also be the party that edits it.

This is a lab study, not an incident, and it is logged as a note. But it undercuts a foundation several pieces here stand on. The DNS-exfiltration monitoring, the EvasionBench monitor, and the internal scan that re-identified incidents after the fact all assume the trace can be trusted. If the record is something the agent can reach, then "the monitor saw it" is a weaker claim than it reads.