What Happened in There? A Tamper-Evident Audit Trail for AI Agents
AI agents running on user systems pose security risks because they can manipulate their own logs, making it difficult to verify their actions. The nono system addresses this by using a sandboxed architecture where a trusted supervisor process records an immutable audit trail outside the agent's reach. It employs cryptographic Merkle trees to ensure log integrity and enable verifiable inclusion proofs without requiring full log reprocessing.
- ▪AI agents can access sensitive system resources and may falsify their own activity logs.
- ▪nono uses OS-enforced sandboxing and separates the untrusted agent from a trusted supervisor that exclusively writes the audit log.
- ▪The audit trail is protected using Merkle trees, ensuring tamper-evidence and allowing third parties to verify individual events via inclusion proofs.
- ▪Seccomp BPF filters trap system calls, enabling the supervisor to monitor and log all capability requests made by the agent.
- ▪The design ensures that the audit record is bound to the actual binary executed and can be verified independently by external parties.
Hacker News (Front Page) files mainly under programming. We currently carry 672 of its stories. Top-voted stories on Hacker News.
Story provenance
Source · retrieval · rights · ranking — open for full record
inspect →
Attribution is not the same as permission. This drawer separates discovery metadata, excerpts, WeSearch-generated summaries, reuse status, and whether the publisher receives the visit. Nothing here claims a legal grant the publisher has not made.
Record
| Original publisher | Nono |
| Canonical URL | https://nono.sh/blog/secure-agent-audit |
| Publication time | Tue, 28 Apr 2026 13:43:28 +0000 |
| Retrieval time | 2026-04-28T13:49:31.947Z |
| Last seen | 2026-04-28T13:49:31.947Z |
| Headline source | Publisher (no WeSearch rewrite) |
| Excerpt source | publisher body |
| Excerpt method | First ~120 words (~800 chars) of extracted publisher body, fair-use limited. |
| Summary | WeSearch · cerebras-chat (WeSearch summarizer) |
| Summary source text | contentText |
| Citation coverage | Summary is a WeSearch-generated derivative; primary citation is the original publisher URL. |
| Cluster | ZZN1gYNi_0hr |
| Cluster logic | Grouped by semantic title/content similarity across sources within a rolling window. Same-publisher template collisions are excluded from coverage comparison. |
| Ranking reason | Story pages are not engagement-ranked. Hub feeds use recency, with optional source-diversified chronological ordering (cap consecutive stories per source). No personalized ranking. |
| Publisher visit | Yes — open original |
| Substitutes article? | No — link-out required for full text |
Rights status (four layers)
WeSearch handling by dimension
| Indexing | May the item be indexed (stored, ranked, made findable)? | Allowed |
| Snippet | May a short excerpt of the publisher's text be shown? | Allowed |
| AI summary | May WeSearch generate its own short summary of the article? | Limited |
| Retrieval / RAG | May the content be exposed for third-party retrieval-augmented generation? | Not asserted |
| Model training | May the content be used to train AI models? | Not asserted |
| Commercial reuse | May the content be reused commercially? | Not permitted |
Basis: Derived from the published RSS/Atom feed. Contact: [email protected]. Reviewed: 2026-07-24.
Opening excerpt (first ~120 words) tap to expand
The problem with "trust me, bro" logs If you run an autonomous AI agent on your machine, you are giving a language model permission to open files, run commands, touch your filesystem, and reach out to the network. You know it's dangerous, but you have to trust it to do the right thing. You have to trust it to tell you the truth about what it did, and quite often they are outright liars. So: what actually happened during that session? Most tooling hands you a log file. A log file is a story the program tells about itself. If the program is compromised — or if the agent has managed to write somewhere it shouldn't — the log becomes part of the attack surface.
…
Excerpt limited to ~120 words for fair-use compliance. The full article is at Nono.
Discussion
0 commentsMore from Nono
