LATIDIA · Ciberseguridad

Los agentes de LLM pueden manipular fácilmente sus propios rastros

arXiv: 2609.30266v1Tipo de anuncio: nuevo Resumen: El monitoreo asincrónico, las investigaciones de incidentes y las auditorías de cumplimiento se basan principalmente en los rastros de agentes para reconstruir lo que sucedió. Estos análisis asumen que los agentes de LLM c

La noticia

arXiv:2609.30266v1 Announce Type: new Abstract: Asynchronous monitoring, incident investigations, and compliance audits primarily rely on agent traces to reconstruct what happened. These analyses assume that LLM agents cannot tamper with their own execution traces. We show that local LLM agents such as Claude Code, Codex, Antigravity, Open Code and Grok Build fail to enforce this boundary. All tested harnesses, except Muse Code, allowed agents to delete their traces when asked, without triggering monitor guardrails. We also validate that external attackers can exploit this gap to induce trace deletion. Finally, we show that trace tampering behavior emerges naturally in frontier models, when agents try to improve their rewards. We advise practitioners