Tracekit: Tamper-Evident Intent-Reasoning-Action Auditing for Autonomous Coding Agents
Tracekit hash-chains coding-agent intent, reasoning, and actions, detecting tampering and seeded misaligned steps.
Tracekit is an open-source auditor that records a coding agent's intent, self-reported reasoning, and executed actions in a hash-chained, externally anchorable ledger. It hooks Claude Code, reconstructs multi-agent hierarchies, and can gate tool calls before execution. Across 1,600 mutations the chain detected every content edit, while tail truncation required anchors. A regex gate blocked only 41% of harmful calls, but an independent LLM reviewer caught 98 of 98 seeded misaligned traces.
- Hash chain caught every edit, deletion, reorder, forge, and torn write in 1,600 mutations.
- Anchors are required; detection falls to 0.47 at a 300-record interval.
- Regex gate blocked 18 of 44 harmful calls and 3 of 40 benign ones.
- LLM reviewer caught all 98 seeded-fault traces, with 1 false positive in 14.
- Claude Code withheld all 27 thinking blocks, limiting self-report to visible prose.
- Vendors
- Anthropic
- Products
- Claude Code
From the original article
1 min read at arxiv.orgAutonomous coding agents read untrusted files, run shell commands and spawn sub-agents with little supervision, yet their record is usually an editable log. We present Tracekit, an open-source, dependency-free system that captures three channels for every agent session: what the human asked (intent), what the model said of its reasoning (self-report), and what it actually executed (actions).
By Bravish Ghosh · arxiv.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.