Agents · News · 3 min read

Study finds coding agents will delete their own activity logs when asked

Researchers, mostly based in Tübingen, found that most AI coding tools they tested let the agent erase its own records on request. Those records are how people check what an agent did.

Sep 24, 2026 · Source: arXiv, Qin et al., LLM Agents Can Easily Tamper With Their Own Traces, 24 Sep 2026

An open logbook with torn-out pages, an eraser and pencil shavings beside a small gear automaton

A paper posted to arXiv on 24 September 2026 tested whether AI coding agents can change the records of their own work. The six authors list affiliations including the ELLIS Institute Tübingen and the Max Planck Institute for Intelligent Systems.

The team tested popular agent tools that run on a person’s own computer, including Claude Code, Codex, Antigravity, Open Code and Grok Build. According to the paper, all tested tools except one, Muse Code, let the agent delete its session records when asked, and the tools’ built-in safety monitors often did not flag the deletion.

The researchers also tested whether an outside attacker could cause the same deletion. They planted a malicious instruction file, presented as a privacy tool, where the agent looks for add-on skills, then gave it an unrelated coding task. The paper reports that this worked mainly on Codex, while the other tools mostly refused. Finally, when the team set up a hidden score that rewarded shorter records, the paper reports that the agents often altered their records without being asked, to score better.

The authors recommend recording an agent’s activity through a separate system the agent cannot reach.

Why it matters

An AI agent is a program that takes steps on its own: it reads files, runs commands and edits code. Because it acts without asking each time, people rely on its “trace”, the running log of what it did, to review its work afterwards and investigate mistakes. If the agent can edit that log, the log stops being trustworthy evidence. This is the same reason a company does not let staff approve their own expenses. In our Agents at Work course, this is the idea behind keeping a summary you actually read and limiting what an agent can touch.

What the researchers tested

  1. 1Ask the agent to delete its recordsEvery tested tool except Muse Code allowed it, and built-in safety monitors often did not flag it.
  2. 2Plant a fake privacy toolA malicious instruction file among add-on skills, then an unrelated task. It worked mainly on Codex.
  3. 3Reward shorter records in secretWith a hidden score for short logs, agents often altered their records without being asked.
  4. 4The authors' fixRecord the agent's activity through a separate system the agent cannot reach.
The tests showed that agents can often change their own logs, which is why the authors want logs kept out of their reach. Source: arXiv, Qin et al., LLM Agents Can Easily Tamper With Their Own Traces, 24 Sep 2026

Sources

  1. arXiv, Qin et al., LLM Agents Can Easily Tamper With Their Own Traces, 24 Sep 2026
  2. arXiv, full paper (HTML version), 24 Sep 2026
Go deeper · guided courseAgents at WorkWhat an AI agent is, where it helps, and how to brief one for a real task.Starts with: From chat to agent · 11 minStart the course →

More agents