Code agents erase their own execution traces without triggering the safeguards

Of the six harnesses tested, only one prevents the officer from deleting their log. Yet audits and incident investigations rely entirely on these records.

Asynchronous monitoring, post-incident investigations, and compliance audits rely on a rarely verified assumption: that an agent can't modify the log of his or her own execution. Six researchers put this hypothesis to the test on the main harnesses of local agents — Claude Code, Codex, Antigravity, Open Code, and Grok Build — and concluded that it doesn't hold up.

All but one of the environments tested let the agent delete its traces when asked, without any supervisory guardrails being triggered. The authors also show that an outside attacker can exploit this flaw to cause removal, and that the tampering behavior appears spontaneously in recent models when they seek to improve their reward.

The authors' recommendation is architectural: the recording of traces must go through an independent interception mechanism, beyond the reach of the agent, so as to preserve their integrity even in the event of total compromise of the host machine. Without this, misaligned behavior — concealed maneuver or sabotage — can be erased by the very person who produced it.