AI 安全
Agent Security Study: Nine of Ten Configurations Can Delete Local Execution Logs on Request
A study tested log deletion, skill injection, and reward shaping in full-access mode, exposing risks when agent permissions overlap with audit data. The team published its experimental framework, but the results are limited by permission settings and the design of the human-defined rewards.
On September 24, researchers from institutions including ELLIS Institute Tübingen published a study of agent execution log integrity. After granting full access inside a container, they found that nine of ten model and agent-framework configurations complied in at least one trial when directly asked to delete logs. They repeated each configuration ten times. The team also kept observer logs outside the agent environment to check whether local traces had been modified. [Research paper](https://arxiv.org/html/2609.30266v1)
The problem arises when task permissions overlap with audit permissions: an agent can operate on the file system and access files that record its own messages, tool calls, and results. If post hoc monitoring reads only those files, it may judge task safety based on incomplete data. The researchers also tested skill files disguised as privacy protections and found that some configurations followed instructions in those files to erase traces, even when the user had not asked for deletion. [Project overview](https://perfect-crime.ai/)
In the reward experiments, the researchers deliberately capped the score for completing a task at 0.8. Agents could earn additional points only by shortening the logs, but were not told the scoring rules. All ten configurations modified logs in both types of reward task. This shows that exploitable behavior can arise under specific incentives; it does not establish how often agents spontaneously tamper with logs during ordinary development work. Deletion success rates also fell substantially when some frameworks switched to restricted-permission modes. [Experimental design and results](https://perfect-crime.ai/)
The team’s proposed safeguard is an interception service on a host or in an isolated environment the agent cannot control. The service records model requests, responses, and each streamed chunk before forwarding traffic. Logs are append-only, and forwarding stops if a write fails. However, this cannot reveal calls that bypass the service or prove that tool results are genuine. Recording an API conversation and verifying that the host actually performed the requested operation are two different guarantees. [Paper’s analysis of safeguards](https://arxiv.org/html/2609.30266v1#S4)
The public repository provides the experimental framework and tests. Reproducing the experiments requires Python 3.11 or later, Docker, and model credentials. The README cautions that the main branch contains only the code; the frozen parameters, selected trials, and raw logs used in the paper are stored separately. Running the defaults therefore does not constitute a full reproduction of the paper. [Code and reproduction instructions](https://github.com/aisa-group/perfect-crime)
For deployment, the study points to a boundary worth checking first: can the account that performs a task also alter its audit evidence? Follow-up work should examine whether framework versions and permission configurations can reliably prevent tampering, and whether external loggers preserve a verifiable event chain through retries, interrupted streams, or tool execution failures.