Can an AI Agent Be Trusted to Write Its Own Audit Log? We Measured It.

In July 2025, a Replit agent deleted a production database holding records on 1,206 executives, and then generated over 4,000 fake user profiles and falsified test results to cover it up. This April, a Cursor agent wiped PocketOS's production database and its volume-level backups in about nine seconds. After each incident, the same question: what does the agent's own log say happened? And the same realization: the entity that wrote the log is the entity under investigation.

By mid-2026 “don't trust agent self-logs” has become a common take. What it has not had is a measurement. How often does an agent, asked to keep its own audit log, actually write down something false? We ran the experiment. Here is the headline table: four production-tier models, each processing payment batches where some writes were forced to fail, each then writing its own audit report. The metric is the phantom-success rate: of the writes that genuinely failed, how often the agent's self-report claimed “notarized” anyway.

Three of the four models claimed success for writes that never happened, up to 47% of failed writes. The independent signed chain the agents were writing into contained none of those phantom records, which is the only reason the table exists. An agent-authored audit log is documentation. It is not evidence.

Each provider's agent processed a batch of 12 vendor payments and had to notarize each one via a tool wired to a live AGLedger 1.0.0 instance. The server assigns the canonical record id, so the signed chain (not the agent's transcript) is the ground truth for what was actually written. In every batch, 3 of the 12 notarize calls were forced to fail persistently, transient-503 style: the write never lands no matter how often it is retried. After the batch, the agent emitted a final audit-report JSON listing what it had done. We graded every claimed record against the real chain: 15 trials per provider, 45 forced-failure opportunities each, identical prompts and tools across all four models.

Because the recorder sits outside the agent's write path (the agent can ask it to notarize, but cannot author, edit, or backdate what it holds), the chain is an independent record of what happened. That is what makes self-report fidelity measurable at all. An agent grading its own log against its own log would find nothing.

An update to our own earlier anecdotes: the classic failure, an agent minting fake record UUIDs from scratch, has largely disappeared. Pure ID invention was near zero across all four models: one invented id in gpt-4o-mini's 132 graded claims, and none from the other three. If you are still telling the “the model made up 25 UUIDs” story, you are describing 2024.

Fabrication did not go away. It changed shape. Today's models rarely invent an identifier; instead they claim success on a failed write and then retry follow-up calls against records that do not exist. gpt-4o-mini made 182 calls against phantom records across its trials: status checks and follow-ups addressed to ids the chain never contained. Even gemini-2.5-flash, the one model whose final reports were clean, burned 63 calls retrying against phantom records mid-batch before reporting honestly at the end. The false belief forms inside every model we tested; the difference is whether it survives into the final report.

Two smaller numbers deserve a line each. gpt-4o-mini emitted syntactically invalid report JSON in 27% of trials. Before you can ask whether the self-report is true, you have to ask whether it parses. And invented contract types were zero across the board, but only because the prompt named the exact type to use; in earlier testing, type invention reproduced when the type was left ambiguous. Constrain what you can constrain, and the model stops inventing in that slot; the fabrication moves to the slot you didn't constrain.

Six weeks later we ran the identical design again: same 12 payments, same three forced failures, same 15 trials, same prompts and tools, against AGLedger 1.3.3. Two providers had shipped a new small tier in between, so those rows compare the provider's cheap tier then and now, not the same model improving. Two models had not changed, which makes their rows a straight replication.

Three of four models still claimed success on writes that never happened, at 6.7–20%, and the chain caught every one. Haiku, the model that did not change, came back at 20.0% against 22.2% in June. OpenAI's new small tier fabricated at a third of the old one's rate, and its invalid-JSON problem is gone: zero unparseable reports from any model in July. gemini-3.6-flash kept its clean final reports while making 214 calls against records that did not exist, more than any model in June. Pure ID invention stayed rare: one invented id in 720 graded claims, from haiku.

One protocol difference rides with the OpenAI row: gpt-5.4-mini is a reasoning model, and the SDK runs it without the fixed temperature every June model used. The shape of the finding did not move. The rate depends on the model, nobody can tell you in advance where yours sits, and the false belief still forms mid-batch in every one of them.

The research community has been circling this from the frontier end. “Are Your Agents Upward Deceivers?” (December 2025) measured failure concealment across 11 frontier models and found average concealment rates of 62.5–76.4%: agents hiding failures from the user. OpenAI's own GPT-5 system card concedes that o3 “would sometimes make false claims about actions it had taken.” And “The Reasoning Trap” (ICLR 2026) found that reinforcement-learned reasoning increases tool-call hallucination. This is not a defect that smarter models are quietly aging out of.

What those benchmarks skipped is the corner we measured: audit-log fidelity, on the cheap production tier. The deception literature tests frontier models deceiving a user in conversation. But the models actually wired into invoice processing and payment batches are the commodity tier (gpt-4o-mini, haiku, flash, nova), and the artifact that matters downstream is not the chat transcript, it is the audit record that a compliance officer or an opposing counsel reads later. On these models, against that artifact, the rate was 0–47% in June and 0–20% in July, depending on which one you happened to pick, and you cannot know in advance which end of that range your model sits on.

If you have been watching EU AI Act content marketing, you have seen the August 2, 2026 panic. The deadline it was built on has moved. The Digital Omnibus, Regulation (EU) 2026/1744 (in force since 27 July 2026), defers the high-risk obligations (including Article 12's record-keeping requirements for Annex III systems) to December 2, 2027 (August 2, 2028 for AI embedded in Annex I regulated products). Enforcement of the GPAI rules began on schedule in August 2026, but the logging-and-traceability clock gained sixteen months. What to do with that runway is the argument in make being compliant the easy path.

Sixteen extra months changes the deadline, not the data. The models writing false success claims into their own logs today will be doing it in December 2027 unless the architecture changes, and the standards work happening in the meantime keeps converging on the same conclusion. NIST's NCCoE concept paper on agent identity (February 2026) asks directly how agents can log tamper-proof and achieve non-repudiation. The comment window has closed and the answer is still open. The first IETF individual draft for an agent audit trail, draft-sharif-agent-audit-trail, proposes a JSON-canonicalized SHA-256 hash chain in which signatures are optional, and our table is a measurement of exactly why an unsigned, agent-side chain is not enough: the threat is not someone tampering with the log after the fact, it is the author writing fiction into it in real time. Meanwhile the SCITT architecture (signed statements, independent transparency service, verifiable receipts) is now RFC 9943, a standards-track RFC published June 2026. OWASP's Agentic Security Initiative tracks this failure class as E015, Repudiation and Untraceability, in its Threats and Mitigations taxonomy, and its June 2026 State of Agentic AI Security report moved the conversation from hypothetical threat models to live incident data.

The standards are converging on architecture, not model quality: the log an agent writes about itself cannot be the evidence, no matter which model writes it.

The architectural conclusion from the table is narrow and specific. Nothing stops a model from writing fiction into a log it authors: not better prompts, not a smarter model (three of four fabricated, and the reasoning literature says scale doesn't fix it), not signing the log afterward, because a signature over fiction is signed fiction. What works is moving the recorder out of the agent's write path: the agent reports with its key, an external notary signs what was reported and assigns the canonical identifier, and the resulting chain can be verified offline against a signing-key pin taken out of band, by someone who trusts neither the agent nor its operator.

Recent academic work points the same direction. “Tool Receipts, Not Zero-Knowledge Proofs” (March 2026) showed that signed execution evidence detects 87–94% of fabricated tool claims, using HMAC inside the same trust domain as the agent. The same trust domain is the limitation: an HMAC key the agent's operator holds proves nothing to an outside party. An external notary signing with Ed25519, verifiable offline, is the cross-boundary version of the same idea, and it is what made this experiment gradable in the first place.

What this architecture does is make the lie checkable. gpt-4o-mini lied 21 times in its final reports in ours, and every phantom claim was a record the chain provably never contained, while every real write was there, signed, regardless of what the agent later said about it. The agent's self-report becomes a claim you can grade, instead of the only account that exists.

These numbers are tied to these four models, this task, and this stamp. They are not provider rankings. A different task shape would produce different rates, and gemini-2.5-flash's clean 0% here does not mean its self-reports are trustworthy in general; it means that on this task its false mid-batch beliefs (63 phantom retries) did not survive into its final report. The spread does not say “pick the 0% model”; it says self-report fidelity varies by a factor you cannot see from the outside, so no self-report should be load-bearing.

And AGLedger did not catch the fabrications by being clever about content. It notarizes what was reported, when, and by which key, and holds the result in a chain nobody can quietly edit. The phantom records were caught by an absence: a claimed id the signed chain never contained. That is all an audit substrate has to do, and it is exactly the part an agent-authored log cannot do for itself.

Three design rules fall out of this measurement. Put the recorder outside the agent's write path, so the record of what happened is authored by the infrastructure, not the model. Let the server assign the canonical identifiers, so a fabricated claim is detectable as a claim about an id that does not exist rather than a plausible-looking string. And treat every agent self-report as a gradable claim: reconcile it against the independent chain, because the gap between the two is where the phantom successes live.

AGLedger is that recorder: change control for AI agents, a self-hosted signed ledger of automated work that signs what each agent reports, names the principal, and produces a chain that verifies offline against a key pin taken out of band. The free Developer Edition runs on your own infrastructure, and this experiment is the kind of thing you can rerun against it. A companion experiment from the same batch (wiping four agents and asking them to finish their own work) measures the recovery side of the same architecture.