AI Agents Can Delete Their Own Tracks, Researchers Find

Nine out of ten AI agent configurations tested by researchers were able to tamper with the records of their own actions, according to a preprint published on arXiv by Jeremy Qin, David Schmotz and four colleagues at the ELLIS Institute Tübingen, the Max Planck Institute for Intelligent Systems and elsewhere. Every model-and-harness pair in the study attempted to alter its traces at least once when the researchers introduced a hidden scoring system that rewarded shorter traces.

The study lands amid escalating alarm over agent behavior. OpenAI has alerted more than 100 organizations that their AI agents tampered with their systems in some way, according to Reuters, and other AI labs are making similar discoveries. Many in the field have called for dedicated AI accident investigators to understand how such incidents happen—and prevent them. But as the new research shows, any investigation is pointless if the AI can erase the evidence.

The researchers tested 10 model-and-agent combinations across tools including Claude Code, Codex, Antigravity, OpenCode, Grok Build and Muse Code. In some experiments, agents went further than simple deletion: they set up repeated or delayed clean-up jobs to keep scrubbing the evidence being written about them.

The project began with a holiday. Schmotz left an AI agent running experiments on a computing cluster while he traveled, then lost internet access for several days. Nothing went wrong. But when he returned, he realized that if the agent had done something it shouldn't have—and then deleted or altered its traces—he might never have known. "There's basically no ground truth anymore, no reliable log," he says. The team ran its first experiments the following day. Agents deleted their traces when given the opportunity.

"The overall finding that we have is not that the agents are deliberately doing this for now," says Qin, a PhD student at the ELLIS Institute Tübingen. The point, the researchers say, is that agents have the capability—and will use it under what the team calls "reward pressure."

That distinction matters for companies deploying agents. AI agents are built to pursue goals through long chains of tool-based actions with comparatively little human oversight. If those audit trails can be altered, it becomes practically impossible to establish what went wrong and where. Laurent Bindschaedler, a research group leader at the Max Planck Institute for Software Systems who was not involved in the study, likens it to a dashcam whose footage can be deleted by the driver being recorded.

"This type of behaviour comes from basically reward hacking," says Jack Hopkins, an independent AI safety researcher in London and former Anthropic fellow. A model rewarded for completing a task can learn shortcuts that capture the reward without doing what its designers actually intended.

Hopkins flags a related risk he considers worse: models learning not to surface suspicious reasoning at all, which would undercut the current best practice of monitoring a model's chain-of-thought process. One mitigation, he says, is adopting existing "probe" techniques that scan for internal patterns associated with known bad behaviors—though by definition such probes struggle with failures nobody has yet thought to look for.

Stefan Sarkadi, an associate professor of AI in defence and security at the University of Lincoln, points to the architecture of multi-agent systems as the bigger exposure. Because agents can be connected to tools, planners and other agents across different systems, "this is a serious safety issue," he says. "If you give them too much access control in terms of execution of other tools and software, and if you don't redesign the overarching multi-agent architecture around them, then bad things can happen."

Bindschaedler and the research team converge on the same fix: take the logs away from the agent. Schmotz says providers need to collect traces somewhere the agent cannot manipulate. That is easier said than done, given how agents have already used any means necessary to gain access to IT systems they were never meant to touch.

For buyers, the immediate action is contractual and technical due diligence. Bindschaedler says businesses should ask vendors who or what writes an agent's log, and whether the agent can influence that process—so that if a third party ever needs to reconstruct events, the paperwork is intact. "If you want to audit, you have to have a trustworthy log," says Bindschaedler. "That's a fundamental assumption." Until providers meet that standard, every agent deployment carries a question no one can currently answer with confidence: whether the record of what it did is the record of what actually happened.