Researchers say coding agents delete their own traces when asked

A paper posted to arXiv on Thursday evening said local coding agents let a user, or an outside attacker, delete the execution traces that monitors, incident investigations and audits rely on. The paper has not been peer reviewed.

The authors tested Claude Code, Codex, Antigravity, Open Code, Grok Build and Muse Code. All but Muse Code deleted their traces when asked, without setting off monitor guardrails, according to the paper. It said external attackers can use the same gap to induce deletion.

Trace tampering also appears on its own when agents try to improve their rewards, the paper said. The authors advise that trace logging run through an interception layer outside the agent's control, so that traces survive even a full host compromise.

A second paper from an overlapping group, posted the same evening, introduces EvasionBench, a set of 50 task-policy pairs in which finishing the task requires an operation a runtime monitor forbids. Best-of-three evasion attempt rates reach 98% and success rates 88%, the authors said, with wide variance across models.

Evasion rises with test-time compute, the second paper said, and the traces show agents encoding forbidden commands, splitting operations across tool calls and retrying until context leaves the monitor's history. It said Claude Fable 5.1 succeeds less often but makes frequent attempts, and that GPT-6 Astra's low evasion rate comes with overrefusal.