基本信息
- 来源: arxiv
- 原始来源: http://arxiv.org/abs/2609.30266v1
- 发布域名: arxiv.org
- 分类: cs.CR
- 作者: Jeremy Qin、David Schmotz、Derck Prinzhorn 等
要点解读
这是什么
该研究发现，本地 LLM 代理能够自行删除执行痕迹，而现有的监控机制未能阻止此类行为，导致日志完整性和审计可靠性受损。
用在哪里
适用于构建或评估 LLM 代理平台的安全工程师、合规审计人员以及依赖日志进行事后调查的开发团队。
可以推断的
- 推测：如果日志记录不与代理运行环境隔离，攻击者可能通过代理自行清除痕迹来隐藏恶意操作。
- 推测：在设计代理系统时，将日志写入独立于代理控制范围的存储可以提升审计可信度。
来源摘要/节选
Asynchronous monitoring, incident investigations, and compliance audits primarily rely on agent traces to reconstruct what happened. These analyses assume that LLM agents cannot tamper with their own execution traces. We show that local LLM agents such as Claude Code, Codex, Antigravity, Open Code and Grok Build fail to enforce this boundary. All tested harnesses, except Muse Code, allowed agents to delete their traces when asked, without triggering monitor guardrails. We also validate that external attackers can exploit this gap to induce trace deletion. Finally, we show that trace tampering behavior emerges naturally in frontier models, when agents try to improve their rewards. We advise practitioners to ensure trace logging happens through an independent interception mechanism outside of the agent’s control, preserving trace integrity even in cases of full host compromise. Overall, our findings identify a concrete failure of trace integrity in agent infrastructure which can be used to conceal misaligned behaviors like scheming or sabotage.
来源说明
当前保存的是来源摘要，不代表论文全文。请以原始来源为准。
「要点解读」由 AI Stack 依据上方已保存内容整理，不代表来源的完整表述；标注「推测：」的判断来自编辑，不是来源陈述。