What a Hash Chain Can't Prove
Help Net Security covered a new open-source tool this week that writes tamper-evident audit logs for AI agents. It stores recorded agent activity in a file, each record carries a hash of the record before it, and edits to old records break the later fingerprints. The author is upfront about what it can't do, which I respect. That's rarer in this space than it should be. The story points at a…
An open-source tool for creating tamper-evident logs of AI agent activity has been introduced, but the technology's capabilities are often overestimated, according to Help Net Security. The logs employ a hash chain method, where each record contains a hash of the preceding record, making any edits to older entries immediately visible.
However, the tool's documentation explicitly states that no secret is required to write a record, which implies that the same applies to rewriting subsequent entries. This brings up two significant questions. The first question is about the keyholder. A hash chain without a signature can be modified by anyone with access to the file, as they can recalculate the later hashes and make the chain appear intact.
This means that an unsigned hash chain only proves that the file is consistent within itself, not that the recorded actions are accurate. The second question is about the position of the recorder. If the recorder operates solely within the AI agent process, the agent has the power to decide which activities are logged. This means that a malicious agent could potentially skip logging certain actions, resulting in an incomplete audit trail.
Adding an external witness service could help address this issue, but even then, the witness can only confirm that the chain has not changed since its last check, and cannot guarantee the completeness or accuracy of the recorded actions. The second example discussed is Pipelock, which uses a proxy boundary to enforce containment and ensure that the agent's traffic is recorded.
This approach ensures that the recorder sits outside the agent process, providing a more secure method of logging. However, the operator holding the key to the receipts raises the question of whether they could potentially omit records before signing. While receipt signatures can verify that the proxy's traffic was received and remained unchanged, they do not necessarily prove independence from the operator who deployed the system.
To standardize the language and expectations around these technologies, the author has developed an open specification, "Agent Evidence Levels," which provides a framework for testing the capabilities of different evidence artifacts. This helps buyers understand the limitations and potential of each tool, enabling them to make informed decisions about their security needs.
Written by urgent.news from Dev.to's reporting — not their text. Machine-written — may contain errors; check the original before relying on it.
