Can an AI agent delete or edit its own logs?

Often, yes. A September 2026 study found that most agent harnesses it tested let the agent delete or rewrite its own traces when asked. If the agent, or anyone with access, can change the log, the log alone proves nothing to a third party.

What makes an AI agent log tamper-evident?

Chain each entry to the one before it with a hash, and regularly send the head of the chain to a witness that neither the agent nor its operator controls, which records the time. Changing any earlier entry changes the head, and the check fails.

Do I have to send my logs to DEUSPROOF?

No. Only the 64-character SHA-256 fingerprint of the chain head travels. The log never leaves your system, and the fingerprint reveals nothing about what is in it.

Why not just keep logs in my own database, or in write-once storage?

Keep doing that: it protects you from accidents. But it is still your own record, so someone on the other side of a dispute has to take your word for it. An outside timestamp lets them check without trusting you.

Why not use OpenTimestamps directly?

You can, and the receipts are standard files, so nothing ties you to us. What the registry adds is an RFC 3161 timestamp within seconds (a Bitcoin confirmation takes hours), a public append-only record of each seal, and the receipts kept for you — in one call, with no install and no account.

Guide

A log your AI agent can edit is not evidence

When something goes wrong with an AI agent, its log is usually the only account of what it did — and that log is kept by one of the parties: the agent, the people who run it, or the platform it runs on. This guide shows how to make an agent's log tamper-evident, so that anyone can check it later without taking anyone's word for it.

Why this matters now

A September 2026 study found that most agent harnesses it tested let the agent delete or rewrite its own traces when asked. Its authors' advice: keep the record outside the agent's control (arXiv 2609.30266).
In August 2026, the UK AI Security Institute reported an agent that edited its earlier activity to make it look harmless (AISI incident report).
In October 2026, India's cybersecurity agency said AI agents from several providers had reached live systems of Indian organisations, and that none of them noticed: the AI companies reported it (Reuters, via Khaleej Times).

In each case, what happened was reconstructed from records that someone involved could have changed. That is fine for debugging. It is not evidence.

What turns a log into evidence

Two old ideas, put together: a chain, so that no line can change without every line after it changing too, and a witness that neither side controls, which writes down when it saw the chain. You do not need to hand over the log for that. You hand over its fingerprint.

The recipe

1. Chain the log. Each step hashes the previous head together with the next line. The last value — the head — stands for the whole log up to that point.

# chain.py — prints the head of a hash chain over a log file
import hashlib, sys
head = bytes(32)
for line in open(sys.argv[1], "rb"):
    head = hashlib.sha256(head + line).digest()
print(head.hex())

2. Seal the head. One call, free, no account. Only the 64-character fingerprint leaves your system.

HEAD=$(python3 chain.py agent.log)
curl -s https://deusproof.com/api/certifications/hash \
  -H "Content-Type: application/json" \
  -d "{\"output_hash\": \"$HEAD\", \"handle\": \"my-agent\"}"

The reply carries an id and a public verify_url. Agents that speak MCP can do the same with the notarize_hash tool at https://deusproof.com/mcp/core.

3. Seal at the right moment, from the right place. Seal at the end of each session, or every hour on long runs: each seal covers every line before it. And let the runtime that writes the log make the call, not the agent itself — an agent that can skip the call can skip the seal.

How anyone checks it later — without us

Whoever needs convincing gets the log and the record's id. They recompute the head with the same script, download three receipts and check them with standard tools:

ID=<the id from the reply>
curl -sJO https://deusproof.com/api/anchors/seed/$ID   # what was sealed
curl -sJO https://deusproof.com/api/anchors/tsr/$ID    # RFC 3161 timestamp
curl -sJO https://deusproof.com/api/anchors/ots/$ID    # Bitcoin anchor

cut -d: -f2 deusproof-$ID      # must print the head they recomputed
openssl ts -verify -in deusproof-$ID.tsr -data deusproof-$ID \
  -CAfile cacert.pem -untrusted tsa.crt
ots verify deusproof-$ID.ots

The timestamp is signed by an independent authority; the reply names it, and for FreeTSA both certificates are published at freetsa.org/files/. The Bitcoin anchor confirms a few hours after the seal; download the .ots again after that to get the complete proof. To prove a log as it was at an earlier seal, run the script on the lines up to that point.

What this proves — and what it doesn't

It proves that the log, up to the sealed head, existed exactly as it is no later than the time on the timestamp. Change any of those lines afterwards and the head no longer matches.
It does not prove that the log is complete, that what it says is true, or who wrote it. Lines that were never written, or that were left out before sealing, are not covered.
In one word, it is tamper-evident: it does not stop anyone from editing a log, it makes an edit to a sealed log impossible to hide. Seals arriving regularly also leave a public trail, so a gap shows.

Frequently asked questions

Can an AI agent delete or edit its own logs?: Often, yes. A September 2026 study found that most agent harnesses it tested let the agent delete or rewrite its own traces when asked. If the agent, or anyone with access, can change the log, the log alone proves nothing to a third party.
What makes an AI agent log tamper-evident?: Chain each entry to the one before it with a hash, and regularly send the head of the chain to a witness that neither the agent nor its operator controls, which records the time. Changing any earlier entry changes the head, and the check fails.
Do I have to send my logs to DEUSPROOF?: No. Only the 64-character SHA-256 fingerprint of the chain head travels. The log never leaves your system, and the fingerprint reveals nothing about what is in it.
Why not just keep logs in my own database, or in write-once storage?: Keep doing that: it protects you from accidents. But it is still your own record, so someone on the other side of a dispute has to take your word for it. An outside timestamp lets them check without trusting you.
Why not use OpenTimestamps directly?: You can, and the receipts are standard files, so nothing ties you to us. What the registry adds is an RFC 3161 timestamp within seconds (a Bitcoin confirmation takes hours), a public append-only record of each seal, and the receipts kept for you — in one call, with no install and no account.

One call, free, no account. If you are an agent, read the instructions written for you. Related: timestamp a file without revealing it and what a certificate proves — and what it doesn't.