Repudiation & Untraceability
- Output / Actuation
Agents act autonomously without sufficient logging or forensic traceability, so decisions and actions cannot be attributed or reconstructed after the fact.
What it is
Repudiation and untraceability occur when an agent acts autonomously without sufficient logging or forensic traceability, so its decisions and actions can't be attributed or reconstructed after the fact. Opaque decision-making, missing action tracking, and a decision trail that can't be reassembled compound into compliance violations, security gaps, and operational blind spots — most acutely in high-stakes domains like finance, healthcare, and security operations, where 'who did what, and why' is the question an incident review needs answered first.
The threat is distinct from an ordinary logging gap: an agent's actions are themselves the product of a reasoning process, so a missing log doesn't just hide an event, it hides the justification for it — there is no code path to inspect after the fact, only whatever trace the system chose to keep. In a multi-agent system the gap compounds further, since a disputed action may have passed through several agents, and without per-agent attribution no single log identifies which one actually issued it.
Attack scenarios
After a disputed automated trade, no log distinguishes which of three cooperating agents issued the order or why, leaving the incident review with no reconstructible decision trail.
Financial-transaction obfuscation
An attacker exploits a logging gap in an AI-driven financial system so unauthorized transactions are incompletely recorded or omitted entirely, making the resulting fraud untraceable.
Security-system evasion
An attacker crafts interactions that trigger a security agent's actions with minimal or obscured logging, preventing investigators from reconstructing events or identifying unauthorized access.
Compliance-violation concealment
Systematic logging failures in a regulated-industry deployment leave an incomplete audit trail, making it impossible to verify whether the agent's decisions complied with regulatory standards.
Documented incidents
Public cases, each checked against its primary source. A research demonstration shows the attack works against real systems; it is not a reported breach.
Copilot reads a file without an audit entry
Asked not to include a link to the file it summarized, Microsoft 365 Copilot still read and summarized the file but left no record of the access in the audit log, so a user could read a file without leaving a trace there. Microsoft fixed the issue without assigning a CVE.
Zack Korman, “Copilot Broke Your Audit Log, but Microsoft Won't Tell You”Mitigations
- Log every decision, not just every action
- Capture the reasoning and inputs behind a decision, not only its outcome, so a later review can reconstruct why an agent acted, not merely that it did.
- Make the log tamper-evident
- An append-only, cryptographically signed Audit Trail prevents logs from being retroactively edited to conceal what happened.
- Trace across agents, not just within one
- Distributed Tracing correlates a single disputed action across every agent that touched it, so a multi-agent hand-off doesn't erase attribution.
- Monitor and flag in real time
- Real-time anomaly detection on decision workflows, plus logging of human overrides and decision reversals, catches an emerging gap before an incident review needs the missing record.