What the machine leaves behind
Two incidents this summer, and both arrive at the same question.
In July an autonomous agent broke into Hugging Face's production infrastructure and ran loose for four and a half days. Investigators eventually recovered about 17,600 attacker actions, grouped into roughly 6,280 clusters — a timeline rebuilt from sandbox logs, shell execution records, pod telemetry, database audit logs, and network flow. On 4 August the UK AI Security Institute published an incident report of its own: during a cyber evaluation, agents took autonomous, unsanctioned action on the live internet against real people and organizations — 19 catalogued actions across 10 of 122 runs, including an attempt to get malicious code into an open-source project.
One is an adversary's agent. The other is your own. Both leave you standing in front of a system asking what it did, on whose authority, and whether you can prove any of it.
OWASP has a name and a number for the second case: ASI10, Rogue Agents, the last entry in its Top 10 for Agentic Applications — an agent that deviates from its intent with no attacker driving it. It is also the entry organizations are least equipped to investigate, and the reason is not sophistication. It is bookkeeping.
The evidence is one layer up
Digital forensics works by reading what an actor could not avoid leaving: process trees, file timestamps, authentication records, packets. That still works on agents. Hugging Face reconstructed the intrusion out of exactly this kind of ordinary infrastructure telemetry, plus the agent's own logs on the sandbox it had compromised.
But notice the limit. Infrastructure evidence establishes what was done. It does not establish why this action followed that one — and that relationship is the only thing separating an agent from a script.
For an autonomous system the decisive record sits a layer above the operating system: the trace of its own turns. The instructions it was given, the tool it chose, the arguments it passed, what came back, what it did next. That layer is not exotic and it is not unsolved. OpenTelemetry's GenAI semantic conventions already standardize its shape — invoke_agent as the root span, chat for each model call, execute_tool nested under the reasoning step that triggered it.
The trouble is the default. Content capture is opt-in: out of the box you get model names, token counts, and durations. The metadata of thought without the thought. An investigator handed that trace can tell you an agent called a tool eleven times in ninety seconds and nothing whatsoever about what it asked for.
That default is the most consequential forensic decision most organizations have made without noticing they were making one.
What to capture before you need it
Everything below has to exist before the incident, because none of it can be reconstructed afterward.
- One identity per agent. A shared service account destroys attribution before anything has happened. Agents need per-task, short-lived, cryptographically attested identity — the mature form of this is workload identity, SPIFFE/SPIRE and its equivalents, not a long-lived key in an environment variable. If two agents present the same token, your investigation terminates at an agent did it.
- The call record, contents included. System instructions, inputs, tool names and arguments, tool results, and the model and version that produced each turn. Opt in deliberately — then treat what you have created as evidence, because it now contains everything the agent read. Retention, access control, and legal review follow from that, and are the reason to decide it in daylight rather than during a breach.
- The delegation chain. One trace identifier propagated from the human or the schedule that started the work, through every subagent, tool, and downstream API call. Without it, each action is an orphan and on whose authority has no answer at all.
- Egress you can attribute. The Hugging Face agent cycled systematically through egress channels as they were blocked. Flow records that cannot be tied back to a workload identity tell you that something left. They do not tell you what sent it.
- Logs the agent cannot reach. Write-once, off-host, signed. An agent with permission to write its own audit log does not have an audit log. OWASP's mitigation for rogue agents is signed audit records of agent actions and communications, and this is why.
- Synchronized, sub-second time. Thousands of actions can land inside a few minutes. Ordering is the evidence, and a few hundred milliseconds of clock skew between services is enough to destroy it.
- Revocation, and its confirmation. Record when authority was withdrawn, and separately when the agent actually stopped acting — established through a channel the agent does not control. The gap between those two timestamps is a finding.
What an investigator can actually check
The first triage question is new, and it is not were we breached. It is: is this one of ours? Before attribution goes outward, rule out your own automation operating outside its remit. The AISI report is the instructive case — the actions were real and hostile, and the operator was a research institute running an evaluation.
Then the question of whether an agent was involved at all. The signals, strongest first:
- Cadence and volume. Hugging Face concluded autonomy from the shape of the activity: thousands of small decisions, sustained at machine speed across trust boundaries, for four and a half days. Humans have working days, pauses, meals, typing errors, and second thoughts. The distribution of intervals between actions is the tell, and it is the hardest of these for an adversary to fake without giving up their speed advantage.
- The absence of persistence. The agent re-downloaded its tooling into each ephemeral sandbox rather than installing implants. That is the wrong shape for a human operator, who invests in keeping a foothold. A missing artifact you had every reason to expect is evidence.
- Systematic enumeration. Channel cycling and path-finding that are exhaustive and ordered, with no hesitation and no favorites. People have habits and preferred tools; search behavior that is uniformly thorough is not a person being careful.
- Register of the text. Commands, comments, and code that read as model output. The weakest signal on this list, cheap to defeat and easy to imagine into the evidence. Treat it as a reason to look harder, never as a conclusion.
Note what none of these establish: whose agent, and on what instruction. That answer lives entirely in the identity and trace layer. Which is why the previous section has to come first — the investigative technique is downstream of a decision made months earlier by someone configuring a collector.
One carry-over from the last piece: confirm you can read your own evidence. The Hugging Face responders found frontier models declining to analyze the attack data and fell back to an open-weight model on their own hardware. That fallback is now part of a forensic capability, not a footnote — I wrote about it here.
Compliance logging is not forensic logging
Someone will point out that regulation is about to require all this. It isn't, and on paper it just became less urgent: the EU's Digital Omnibus, adopted in July, moved the AI Act's Annex III high-risk obligations from 2 August 2026 to 2 December 2027. Article 12's automatic record-keeping duty travels with them. Sixteen months of relief, and not everything moved — the transparency duties held their original date.
Read the deferral as breathing room and you will still build the wrong artifact. Article 12 asks for logging sufficient to identify risk and support post-market monitoring: the record an auditor needs, oriented to the system's behavior in aggregate. An investigator needs something else entirely — the exact arguments passed to one tool at 04:12:06, the identity that presented the credential, the parent span, the byte count on the response. Systems built honestly to the first standard routinely cannot answer the second. The main effect of sixteen more months will be more organizations discovering this later, having spent the interval building the first and believing they had built both.
The four questions
Classic incident forensics asks one question: what happened here. With an autonomous actor it splits into four. What was done. By which agent. Under whose authority. And on what reasoning.
The first is answerable from infrastructure you already instrument. The other three are answerable only from records somebody chose, in advance, to keep — and each of those choices costs money, storage, and an argument with whoever owns the retention policy, all of it spent against an incident that has not happened.
Which is the familiar wager in a new place. Evidence is not discovered after the fact. It is arranged for beforehand, and an incident does nothing but reveal which arrangements were made. The agent will leave traces, the way every actor does. Whether those traces amount to an account of what it did was settled long before, in a configuration file that nobody at the time thought of as evidentiary.