Help Net Security covered a new open-source tool this week that writes tamper-evident audit logs for AI agents. It stores recorded agent activity in a file, each record carries a hash of the record before it, and edits to old records break the later fingerprints. The author is upfront about what it can't do, which I respect. That's rarer in this space than it should be.
The story points at a wider problem with this wave of tools. "Tamper-evident" is starting to read as a synonym for proof. A log that's awkward to edit and evidence that holds up when money or blame is on the line are different things. Two questions expose the difference, and neither one needs a security background.
Question one: who holds the key?
A hash chain with no signature can be rewritten by anyone who holds the file, right up until its head gets checkpointed somewhere outside the operator's reach. Anyone who can alter an old record can recompute the later hashes, and the chain checks out clean again. A bare hash chain only proves the file agrees with itself, and a rewritten file agrees with itself too. An outside checkpoint makes rewrites of already-checkpointed history visible, and that's real progress, but it still can't show which actions the recorder never captured. The docs for the tool in the story say "no secret required; that is the point." For making verification easy, fair enough. For evidence, that's the limit: if no secret was needed to write the record, no secret is needed to rewrite anything that hasn't been checkpointed yet. An unsigned chain is a notebook with numbered pages, not a notarized record.
