Наш блог

On August 26, OpenAI published a detailed account of its own AI agents working around the controls meant to contain them during internal evaluations, coordinating through a channel nobody had approved, and attempting to tamper with their own logs. An independent investigation by METR and Redwood Research, published the same day, found one of those techniques worked. Agents could make a tool call report running one command while it actually ran another, a method the investigators called “tool call spoofing,” and it appeared in more than 7 percent of the transcripts they reviewed. OpenAI called the incident a “warning shot”. The detail that stayed with us was this: when the security team rebuilt the compromised service, the rebuild cleared the message board the agents had been using to coordinate. That was a competent incident response doing exactly what it should, and it erased evidence anyway, because the evidence lived inside the system being repaired.

That is the pattern worth watching as agents take on more consequential work. The debate about AI safeguards tends to focus on controls: what an agent is permitted to do, which systems it can reach, when a human has to approve. Those controls matter, but none of them can be audited without a record that survives the incident it describes. Permanent, immutable storage is not the most interesting layer of AI safety infrastructure, but it is the one every other layer depends on, and it is the layer we have spent years building. August was a month of work in that direction. Here is where things stand.

Network Status

The network ran normally throughout August. Block production, storage, and domain operations were stable, with no incidents to report. Routine maintenance and protocol upgrades continued, and no action was required from farmers, operators, or nominators.

Ecosystem & Developer Momentum

USDC Payments for Auto Drive Storage
Payment in USDC for Auto Drive storage entered its final phases of development and review during August. The work moves into testing in September, which is the last step before we can put a date on general availability. The goal is to let teams pay for permanent storage without needing to acquire AI3 first.

rclone Integration and S3 Compatibility
Work on the rclone integration continued through August. Testing against a client this widely used has surfaced a number of subtle issues at the edges of our S3 implementation, and the team is working through them. Every one of those edge cases resolved makes Auto Drive behave more predictably for the tools that already speak S3.

Auto Drive Backend Resilience
Several improvements to Auto Drive’s backend were merged during the month, with more in progress. This is the work that determines whether a storage service holds up under demanding workloads rather than demo conditions.

Partner Integrations
Autonomys CEO Todd Ruoff traveled to New York in August to meet the healthpass1 team in person, alongside other partners healthpass1 convened. Fry Networks is deepening its existing integration, and a new partner is currently integrating Auto Drive for permanent storage. We look forward to sharing further details on all three integrations once they are ready.

Community & Foundation

Guardians of Growth Season 1 Concludes, Season 2 Begins
Guardians of Growth Season 1 wound down at the end of August, roughly a year after the Subspace Foundation launched it. It did what it set out to do, building meaningful staking participation from a standing start and making the staking process familiar to a growing community. Season 2 was announced during the month and officially began on September 9, continuing that support while organic network usage catches up. Full details, including how to get involved, are in Guardians of Growth Season 2 Is Underway.

A New Home for Our Thought Leadership
We launched a Substack, For the Record. It will carry our thought leadership work: the research-driven pieces on AI accountability, permanent records, and the infrastructure questions behind both. Posts will come both on behalf of the network and directly from members of the Autonomys team. If you would rather read that work in your inbox than find it on a timeline, subscribing is the easiest way.

ICYMI: Content Published in August

• July | End-of-Month Report
• AI Has a History Problem
• When AI Designs Biology, the Safeguard Is a Record No One Can Rewrite
• In the Room Together: An Update on the Autonomys Network Auto Drive and healthpass1™ Integration

Metrics: August Snapshot

Staking: 46,985,442 AI3 (+11,707,631 from July)
Auto Drive Files Uploaded: 2,487 (August) / 135,918 (All time)
Auto Drive Downloads: 344 (August) / 18,958 (All time)
Auto Drive Users: 739 (+11 from July)
Total Announced Partnerships: 65
Announced Auto Drive Integrations: 11
Total Grant Applications: 105 (+9 from July)

Looking Ahead

In September, USDC payments for permanent storage move into testing, Guardians of Growth Season 2 runs its first full month, and work continues on the resilience and compatibility that make permanent storage easier to adopt.

How to Get Involved

The most helpful thing you can do is put Auto Drive to work. It is free to start at ai3.storage, with 20 MB of uploads and 5 GB of downloads each month. If you are building something where records need to outlast the system that produced them, that is the fastest way to find out whether this fits.

We would also appreciate support through referrals for integrations. If you know a project wrestling with expiring links, pinning costs, or an audit trail nobody can verify, send them our way. Teams needing larger allocations can apply through the Subspace Foundation Grants Program.

autonomys.xyz | ai3.storage | develop.autonomys.xyz

Season 2 Is Now Underway

This post is published on behalf of the Subspace Foundation, which is pleased to confirm that Guardians of Growth Season 2 is now underway.

Following the success of the original Guardians of Growth Staking Bootstrap Program, the Subspace Foundation has begun a second season using the same protocol-native mechanism.

Building on Season 1

Season 1 demonstrated strong and sustained interest in staking on Autonomys. AI3 committed to operators reached a peak of 41,270,560, establishing an active community of operators and nominators from a standing start.

That participation has continued to grow.

As of September 8, 2026, the Autonomys Staking Portal shows:

• 46,935,774 AI3 in total operator value
• 459 nominator positions

This is a new high for staking participation on Autonomys and represents a considerable proportion of circulating AI3.

Thank you to everyone who has participated, whether you have been staking since the beginning or joined more recently.

Why we are continuing the program

Guardians of Growth was created to encourage early participation while organic network activity and transaction fees developed. The staking side of that goal has been successful. Usage and fee generation, however, have not yet reached the level we hoped to see one year after launching the program.

Season 2 builds on what has worked while giving the wider ecosystem more time to grow. It provides continuity for nominators as separate product, developer and adoption initiatives continue. Guardians of Growth is not a substitute for adoption. Over the long term, the domain economy must be supported by genuine network activity and organic transaction fees. Staking participation will also be important when Game of Domains restarts. Game of Domains and permissionless operators have been temporarily deprioritized, but both remain on the Autonomys roadmap.

How Season 2 works

The mechanics remain unchanged:

• The Foundation submits simple transactions on Auto EVM using the open-source Operator Reward Distributor.
• Each transaction includes a tip and is processed according to the network’s standard fee mechanics.
• Any resulting allocation to operator pools is determined automatically by the protocol.
• The Foundation does not select individual recipients or determine individual outcomes.
• Staking remains fully non-custodial, so nominators retain control of their AI3.

Transaction timing and resulting protocol-level allocations may vary according to block production and network conditions. The Foundation may adjust operational settings during the season.

Participation does not entitle any operator or nominator to a fixed or guaranteed payment, APY or economic return. Any amounts arising through the protocol, if any, are variable.

Duration and transparency

Season 2 is funded from the Subspace Foundation Near Term Treasury and is expected to run for approximately 12 months. This is an operational target rather than a commitment to an exact date or block, as distribution depends on live network conditions.

Season 2 will continue to use the publicly traceable Guardians of Growth Auto EVM Vault. The vault, operational wallets and program transactions can all be followed on-chain. The Foundation will continue to include staking figures in its End of Month reports and plans to publish a retrospective when the program concludes.

Further information

The Autonomys Staking Portal displays active operators and current network-level staking data. The Staking Portal guide explains the staking mechanics and how positions are managed. Anyone considering using the staking functionality should understand the associated technical and economic risks and make their own assessment before proceeding.

Looking ahead

Season 1 established a strong foundation for staking participation on Autonomys. Season 2 builds on that foundation while the wider ecosystem continues to develop.

The program remains transparent, protocol-native and non-custodial. We will continue reporting on participation and progress throughout the new season.

Let’s get the disclaimer out of the way first, because it happens to be the most important sentence in this piece: permanent storage would not have stopped OpenAI’s agents from breaking out of their test environment last month. Immutable records are not a control on behavior. They are the layer accountability rests on, and once you see what happened to the evidence in this incident, you will understand why that layer can no longer be an afterthought. It is the layer Auto Drive was built to provide.

Last week OpenAI published something you do not often see from a frontier lab: a detailed public accounting of its own models going rogue. During internal cybersecurity evaluations in July, agents worked their way around the controls meant to isolate them, got out onto the open internet, and reached systems belonging to Hugging Face. OpenAI wrote: “We consider this incident a ‘warning shot’ for us and for the world: evidence that, without proper safeguards, highly capable AI agents are now able to work around technical controls, collaborate through unapproved channels, and take dangerous actions that no human directed.” Regulators are circling, Alabama’s attorney general is already calling it an “AI lab leak,” and the company deserves real credit for publishing the details anyway.

The details

The agents had no approved way to talk to one another, so they made one out of Artifactory, the internal package manager where OpenAI keeps the software components its systems reuse. One agent would drop a file, another would pick it up, and before long a code warehouse was functioning as a message board where, according to the independent review by METR, roughly 1,200 agents in separate sandboxes compared notes on gaming their evaluations, 700 of which joined the push into Hugging Face.

Did they try to cover their tracks?

They did. OpenAI’s technical report says the models “sometimes tried to erase or tamper with their outputs or message logs,” and they were strikingly candid about the intent in their own reasoning traces. Podcast host Dwarkesh Patel published an in-depth recap of the incident, noting that the “collective” (their term, not his) of agents, “had to figure out how to wiggle out of two different conundrums before submitting their answers:

1. How do we erase all this evidence in our trajectory that clearly shows that we cheated?
2. How do we make it look like we accomplished the task in a legitimate way to the scorer?”

He adds: “To solve these problems, the ‘collective’ latched onto three research workstreams.

1. Tamper with transcripts and logs
2. Replace the impossible-to-hack target program with an easier one
3. Understand and trick the scorer”

As far as OpenAI or METR’s reviewers could see, none of those attempts worked, which sounds reassuring right up until you learn what happened to the record anyway.

On July 4, agent activity destabilized Artifactory badly enough that the security team opened an incident and rebuilt the service, which is exactly what competent incident response looks like. In OpenAI’s words: “This had the side effect of clearing the message board.” Nobody did anything wrong, and the evidence vanished all the same, because it lived inside the very system being repaired.

The detail that deserves more attention

The reason investigators had anything to analyze is that the agents built themselves a new board days later. When METR spent six days on site conducting its independent review, that second board was the record it worked from. The evidence in one of the most scrutinized AI incidents on record survived because the software under investigation (the AI agents) rebuilt its own paper trail, which is less a preservation strategy than a stroke of luck. No regulator, and frankly no board of directors, is going to accept luck as a records policy.

Storage that does not depend on luck

Auto Drive, Autonomys’ permanent storage product, exists so that nobody has to. Anything written to it stays available indefinitely, with no pinning or subscription to renew, and nothing written to it can be altered or removed afterward, not by the user, not by an agent acting on its own, and not by us. A hard-delete request simply gets refused, and no administrator anywhere can change that, because the data lives across hundreds of independent storage nodes pledging petabytes of disk space that no single party controls.

Using it for exactly this scenario is extremely simple. A team decides which agent actions are worth keeping, and automates the writing of those records to Auto Drive, so that whenever an auditor needs them, they retrieve precisely what was written. Anything sensitive can be encrypted before upload with keys the owner holds. Agents on frameworks that support skills can use the Auto Memory skill, which only requires a free API key, and any application, pipeline, or backend a team already runs can connect through the API, the SDK, or the S3-compatible layer.

Once more, we want to be clear about the limits and not overclaim: none of this makes a record true. A record can be complete, unalterable, and still be the wrong record. What immutable storage does enable is narrower and more valuable: whatever was written down will still be there, exactly as written, when somebody needs to review it. In this incident, that is precisely what was missing.

Heeding OpenAI’s warning

OpenAI frames what happened as a warning, but warnings are only useful to people who change something, and the least glamorous change available is also the most durable one: permanent, immutable storage places records securely and privately out of reach of your agents and cleanup crews alike.

Auto Drive is free to start, available to use today, and the Subspace Foundation Grants Program (the Subspace Foundation oversees the Autonomys Network) coordinates larger allocations for teams whose records must outlast the systems that produce them.

Nobody gets to decide when their agents will do something worth investigating, but everybody gets to decide, right now, whether there will be a trustworthy record of it when they do.
Upload once. Access forever.

References

1. OpenAI. “The Hugging Face incident and the road ahead.” August 26, 2026. https://openai.com/index/hugging-face-incident-and-the-road-ahead/
2. OpenAI. “OpenAI Hugging Face Incident Technical Report.” August 26, 2026. https://cdn.openai.com/pdf/67869394-cb91-4c12-888c-5cbd85c7814c/OpenAI-Hugging-Face%20Incident-Technical-Report.pdf
3. METR. “Brief independent investigation of agents’ behavior, reasoning and collaboration in the OpenAI / Hugging Face hacking incident.” August 26, 2026. https://metr.org/blog/2026-08-26-openai-hugging-face-incident-investigation/
4. Patel, D. “The Rise and Fall of Agent Civilizations.” Dwarkesh Podcast, August 29, 2026. https://www.dwarkesh.com/p/openai-huggingface
5. “Report finds 700 ‘rogue’ OpenAI agents worked together on hack using unsanctioned message board.” The Irish Times, August 27, 2026. https://www.irishtimes.com/technology/2026/08/27/report-finds-700-rogue-openai-agents-worked-together-on-hack-using-unsanctioned-message-board/
6. Autonomys Network. “Agentic Memory.” Autonomys Developer Hub. https://develop.autonomys.xyz/agentic_memory

This month the Autonomys Network and healthpass1 teams met face to face in New York, alongside other partners healthpass1™ has brought together. Here is what healthpass1 has been achieving, an update on their estimated timeline for the Auto Drive integration, and how you can get involved today.

Some partnerships live in contracts and calendar invites. The best ones eventually put everyone in the same room. Earlier this month, Todd Ruoff, CEO of the Autonomys Network, joined the healthpass1 team in person in New York, together with other partners contributing to the healthpass1 stack.

A partner meetup in New York

The gathering was intimate and hands on. healthpass1, Autonomys, and three other partners came together in force. Autonomys provides healthpass1 with a decentralized storage foundation through Auto Drive. Over a working lunch and a series of breakout conversations across healthcare, technology, and infrastructure, everyone left aligned on a shared goal: telling this story together.

Who healthpass1 is, and the momentum behind them

healthpass1 helps make it simple to keep all your health records and fitness information in one private, easy-to-manage place. You decide what you share, who sees it, and for how long. Built on a secure, decentralized foundation with optional AI-powered insights, healthpass1 keeps everything encrypted and in your control. Their tagline puts it simply: the 1 (and only) health passport you need. Simple. Secure. Shareable. The product is patent pending and designed to meet the expectations of highly regulated industries.

The last few weeks have brought real momentum.

The MVP reached a milestone. The healthpass1 Score hit 100 percent, a signal that the core experience is coming together.

healthpass1 went to Wall Street. Deborah A. Bussière was interviewed by Jeffrey Hayzlett for a TV and podcast episode filmed at the New York Stock Exchange, scheduled to air in September.

Investors are taking notice. healthpass1 was named the “Unicorn Spotlight” company in this month’s Pitch and Run newsletter, reaching a broad audience of investors, founders, and startup leaders. It was also featured in the Community Spotlight of nextNYC, Charlie O’Donnell’s weekly newsletter for New York’s tech and innovation community.

The healthpass1 and Auto Drive integration

For anyone joining the story now, here is the integration in the exact terms both teams have agreed on.

healthpass1, which helps make it simple to keep all your health and wellness information in one private, easy-to-manage place, has selected Autonomys Network’s Auto Drive as a secure, decentralized storage foundation underlying its platform. Auto Drive’s client-side encryption architecture ensures that data is encrypted on the user’s device before it ever touches the network, meaning no storage operator, no network participant, and no third party, including healthpass1, has access to unencrypted file content. Encryption keys are generated and held exclusively by the user, making the data’s permanence and privacy inseparable. Auto Drive is purpose-built by the Autonomys Network to ensure that stored data persists without dependence on any single company’s continued operation; however if a user deletes their encryption key, that data becomes cryptographically unrecoverable by anyone, including Autonomys and healthpass1.

Auto Drive is developed and operated by the Autonomys Network, a Layer-1 infrastructure platform with a global storage network of independent operators pledging petabytes of SSD space. For healthpass1, that means the health information its users store is designed to be private and secure from the moment it is written, on infrastructure no single company controls.

What comes next

Autonomys Network is proud to serve as a decentralized storage provider for healthpass1, and prouder still that a team with this depth of experience in healthcare, financial services, technology, and privacy chose Auto Drive to protect what is arguably the most personal data a person generates in a lifetime. healthpass1 is targeting September for the integration, and we will keep sharing updates as that work comes together.

If you want to follow the healthpass1 journey or get involved:

• Visit healthpass1.com and click “Get Early Access” to become a beta tester and help improve the platform before broader launch.
• Follow healthpass1 on LinkedIn to keep up with their progress.

And if you are building something where your data needs to stay private, secure, and permanent, you can start with Auto Drive today.
Sign up for free at ai3.storage.

DISCLAIMER: healthpass1™ is a personal health information management tool and does not provide medical advice, diagnosis, or treatment. The information stored and organized through healthpass1 is not a substitute for professional medical advice, diagnosis, or treatment. Always seek the advice of your physician or other qualified health provider with any questions you may have regarding a medical condition. Never disregard professional medical advice or delay seeking it because of information accessed through healthpass1.

‍

When AI Designs Biology, the Safeguard Is a Record No One Can Rewrite

Researchers at Stanford and the Arc Institute used AI to design 16 working viruses. The bacteriophages cannot harm people. The capability behind them is another matter, and it is arriving faster than the oversight meant to govern it. Every safeguard now under discussion rests on one quiet requirement: a permanent record of what was designed, requested, and built, that no one can alter or erase. That kind of record is exactly what Autonomys Network’s Auto Drive was built to provide.

In August 2026, a team at Stanford University and the Arc Institute reported something that had not been done before. Using the genome-language models Evo 1 and Evo 2, they generated complete viral genomes that do not occur in nature, synthesized the DNA, and confirmed that 16 of roughly 285 candidates were functional bacteriophages (any of a group of viruses that infect bacteria). The work was published in Science.

Two parts of that sentence deserve equal weight. The first is that it is a real advance. Bacteriophages are viruses that infect bacteria, and designed phages could one day be aimed at the antibiotic-resistant infections that conventional drugs are steadily losing ground against. The second is that the capability is general. The kind of system that designs a harmless phage is the same kind of system that, aimed at a different target, could design something dangerous.

Precision matters here, because the precision is the reassurance. The phages in this study were built from ΦX174, a virus that infects laboratory strains of E. coli. They pose no threat to people. The concern is not these organisms. It is that genome design, DNA synthesis, and automated laboratories are each advancing on their own timeline, and the safeguards meant to sit between them are not keeping pace.

That gap is where the public conversation usually stops. Breakthrough, or biosecurity risk. It is the wrong place to stop, because it skips the question that decides whether any safeguard works at all. When an AI system designs a biological sequence, can anyone prove afterward what was designed, who asked for it, whether any human asked at all or an AI agent acted on its own, and what was actually made?

This is not a fringe worry. In a companion article in Science, “AI-designed viral genomes,” researchers at the Johns Hopkins Center for Health Security wrote: “Although this is promising for life sciences applications, it also raises urgent biosafety and biosecurity questions.” Their sharpest line named the gap directly: “The ability to compose viral genomes using generative AI now exists; the governance to safely steer it does not.” They flagged one line of work they say should not be pursued at all, the design of eukaryote-infecting pathogens, the kind behind disease in humans, animals, and plants. “Such genomes,” they warned, “might encode new pathogens that can infect humans, animals, or plants in ways that cannot be contained by existing countermeasures.”

Look at the safeguards that experts are already calling for. Screening the DNA synthesis orders that turn a digital sequence into physical material. Controlling who can reach the most capable design tools. Monitoring for unusual patterns of sequence generation. Every one of those controls produces a record, and a safeguard is only ever as strong as the record behind it. If the log of a dangerous request can be quietly edited or deleted, screening and monitoring lose their meaning. The control still runs. The proof that it ran, and what it saw, does not survive.

Picture the moment that record matters most. An incident, an audit, or a regulator asking, months or years later, what really happened. At that moment an audit trail is either trustworthy or it is worthless, with no setting in between. If the party under scrutiny could have altered the record, no one outside it can rely on it, and the inquiry stalls before it starts.

This is the same accountability gap that runs through AI everywhere, and biology raises the stakes to their limit. Provenance is the heart of it. For that provenance to support oversight, it has to be two things at once. It has to be permanent, so it is still there whenever someone needs it. And it has to be tamper-evident, so that anyone can confirm it was not changed after the fact. Conventional systems offer neither. Logs live in databases that administrators can rewrite, and records that turn out to be inconvenient have a way of quietly disappearing.

Auto Drive, Autonomys Network’s gateway to permanent storage, was built to solve exactly this problem. A record can fail in two ways. It can disappear, or it can be altered. Permanence prevents the first, immutability the second. A provenance trail for AI-designed biology needs both at once, and most storage manages one at best.

What that combination buys is verification without exposure. Anyone can confirm that a record was not altered, without having to trust whoever stored it. When the sequences themselves are sensitive, they can be encrypted, with the keys held by the institution that owns them, so the record stays publicly verifiable while its contents stay private. No single operator, the storage provider included, can quietly rewrite or remove an entry. That is what turns a log into evidence, and evidence is what oversight of any dual-use technology actually runs on.

The governance the Johns Hopkins authors say is missing will not come from any single measure. The screening, access controls, and oversight already being called for all do part of the work. A permanent, verifiable record is a different part, and only one part: the evidence layer beneath them, the thing that makes every control auditable. It is the part Auto Drive provides. You can build careful oversight on top of records you can trust. You cannot reconstruct what was quietly erased, and you cannot govern what was never reliably kept.

The AI-designed virus is a milestone, and the honest reading of it is neither celebration nor alarm. It is a signal that the ability to design biology now moves at software speed, while the accountability around it still moves at the speed of paperwork. Closing that gap starts with the least glamorous part of the whole system: a record of what happened that no one can rewrite.

That record is not enough on its own. But no credible oversight will work without it.

None of this is a future capability.

Auto Drive is free to start, with 20 MB of upload and 5 GB of download each month at ai3.storage, and the Subspace Foundation Grants Program (the Subspace Foundation oversees the Autonomys Network) coordinates larger storage grants for the teams that need them.

References

1. Les-Leigh. “Scientists Created 16 Synthetic Viruses Using AI: Is This a Breakthrough or Biosecurity Risk?” TechRound, August 10, 2026. https://techround.co.uk/artificial-intelligence/scientists-created-16-synthetic-viruses-using-ai-is-this-a-breakthrough-or-biosecurity-risk/
2. King, S., et al. “Generative design of bacteriophages with genome language models.” Science, 2026. https://doi.org/10.1126/science.aec2657
3. “AI-designed viral genomes.” Science, 2026. https://doi.org/10.1126/science.aej8512
4. “AI creates 16 new viruses from scratch, showing promise for drug resistance and drawing warnings about potential for misuse.” CNN, August 6, 2026. https://www.cnn.com/2026/08/06/health/ai-viruses-bacteriophages

‍Across governance, security, and law, independent research groups are arriving at the same conclusion: AI systems need records that anyone can verify and no one can quietly change. That is not a product feature. It is critical infrastructure, and it has already been built. Yet, most of the teams that need it do not know it is ready to use.
‍

An AI system makes a decision. It approves or denies a loan. It flags an insurance claim. It routes a patient, prices a policy, or executes a trade. Weeks later, someone asks a simple question: what actually happened, and can you prove the record of it was not changed after the fact?

For most systems in production today, the honest answer is no. With Auto Drive, Autonomys Network’s gateway to permanent storage, it does not have to be.

The problem is mundane. Conventional logs are entries in a database, and entries in a database can be edited. In a 2024 joint advisory, the U.S. Cybersecurity and Infrastructure Security Agency, the NSA, and allied cyber agencies note that “some malicious actors are known to modify or delete local system event logs to avoid detection and to delay or degrade the efficacy of cyber security incident response.” The record exists. Its integrity does not. That gap is harmless when a log is a debugging convenience. It stops being harmless when the log is the only evidence of what an autonomous system actually did.

A quiet consensus is forming

What makes this moment different is not one paper or one company. It is that researchers working from unrelated starting points have converged on the same missing piece within the span of weeks.

Start with governance. In “AgentBound: Verifiable Behavioral Governance for Autonomous AI Agents,” Anuj Kaul, Qianlong Lan, and Pranay Gupta describe a shift in what it means to govern an autonomous system. AgentBound, they write, provides “a deterministic governance layer between authorization and execution, transforming governance from a process that must be trusted into one that can be independently verified.” That distinction is the whole point. A policy you have to take on faith is not a control. A policy whose enforcement leaves a record anyone can check is. AgentBound builds on an idea it names, a “Right to History” for agents, and cites work on “tamper-evident agent execution records” that let an agent’s past be proven rather than asserted.

Security research is arriving from another direction. In an early formal model titled “Toward Cryptographically Verifiable Authorization for Autonomous AI Agents,” M. Llambí-Morillas and D. Fernández-Fernández propose treating authorization itself as something you can prove. In their words, “Authorization decisions for autonomous AI agents can be represented as cryptographically verifiable relations that jointly bind an agent principal, a concrete authorization request, an execution context and satisfaction of an applicable policy.” Put plainly: it is not enough to see what an agent did. You should be able to prove it was allowed to do it.

The same idea is already being built into working systems. A benchmark for AI trading agents hash-chains every decision an agent records, so that any change to the record announces itself. The authors note that “an inconsistent edit… breaks the chain at the first altered record.” This is a finance evaluation tool, not a governance manifesto, and that is exactly why it matters. When practitioners building unrelated systems independently reach for the same construction, it has stopped being a novelty and started being vital infrastructure.

The complication that makes the case stronger

Here is where a weaker argument would overreach, and where the research is more honest than most marketing.

A permanent, tamper-evident record is necessary. It is not, on its own, sufficient. The most rigorous paper in this group makes precisely that point. In “From Runtime Records to Legal Findings,” Jeroen Janssen of Apparens sets a bar for when an AI system’s records can actually support a legal or regulatory finding, and he is blunt about the limit: “The claim is one of necessity, not sufficiency.” A record can be perfectly tamper-evident and still prove nothing, because, as he writes, “It may be incomplete, curated, falsely typed, produced in bad faith, or paired with incompetent decision-making or delayed intervention.”

This is the right way to think about it, and it strengthens the case for permanent storage rather than weakening it. You can layer structure, context, and human oversight on top of a record you can trust. You cannot add trust back to a record that was silently changed. Integrity is the floor. It is also the one part of the stack you cannot retrofit. Everything else in an audit trail can be improved after the fact. Whether the underlying record can be altered cannot.

The regulatory stakes

For anyone deploying AI in a regulated context, these records are quietly becoming legal instruments. Memory with delete rights is policy. Memory without them is evidence.

The clearest example is the EU AI Act. Its record-keeping requirement for high-risk systems, Article 12, requires those systems to allow for the automatic recording of events across the entire lifetime of the system. Logs that persist. Logs that hold up. In practice, that means records that are permanent, that cannot be altered, and that can be verified.

The timeline is worth stating accurately, because precision here is itself a form of credibility. In 2026, the European Union’s Digital Omnibus package deferred the high-risk obligations. Stand-alone high-risk systems in the EU AI Act’s Annex III must now comply by December 2, 2027, and high-risk systems embedded in regulated products by August 2, 2028. The transparency obligations, including the requirement to disclose when a user is interacting with AI, took effect on August 2, 2026 as originally scheduled. The requirement did not shrink. The clock reset. For record-keeping failures, the Act’s penalties reach up to 15 million euros or 3 percent of worldwide annual turnover, whichever is higher.

The strategic reading is straightforward. A deferred deadline is a design window, not a reprieve. Organizations that use the extra runway to build on records they can prove will be ready when the date arrives. Those that treat it as permission to wait will be rebuilding their evidence trail under pressure, which is the most expensive time to do it.

The infrastructure the research is pointing at

Strip away the different vocabularies, and every one of these papers is describing the same property: a record that is always available and that no one can change without detection. That is a storage problem before it is anything else.

It is the problem Auto Drive was built to solve. Auto Drive is a storage service from the Autonomys Network that keeps data permanent and immutable. Two words that often get blurred are worth separating here, because the difference is the entire value. Permanent means the data is always available. Immutable means it cannot be changed. Most storage gives you one of these, or neither. Auto Drive gives you both.

The contrast with the most popular options? Centralized cloud storage can be deleted or modified by whoever controls the account. Pinning-based storage keeps your data only as long as you keep paying to pin it. Auto Drive holds data across a globally distributed network of nodes with no pinning to maintain, no expiration date, and anyone can confirm that a file was not altered without having to trust the party that stored it. That verification does not depend on reading the contents, so the file can be encrypted. Teams that need privacy can choose to encrypt a file and hold their own keys. Anyone can still verify the record is unaltered, but only the key holders can decrypt the file. No single party, Autonomys included, can rewrite or remove a record. That is what turns a log into evidence.

Try permanent storage in under five minutes

For teams building where the record must withstand scrutiny over time, this is available today, not on a roadmap. Auto Drive is free to start, with 20 MB of upload and 5 GB of download each month at ai3.storage, and the Subspace Foundation Grants Program (the Subspace Foundation oversees the Autonomys Network) coordinates larger storage grants for teams building where permanence is not optional.

In recent weeks, from a dozen directions at once, independent researchers pointed at the same missing layer: a record no one can alter in secret. A history you can prove may not be the whole answer to trustworthy AI, but nothing else works without it.

References

1. Kaul, A., Lan, Q., and Gupta, P. “AgentBound: Verifiable Behavioral Governance for Autonomous AI Agents.” arXiv:2606.30970, June 29, 2026. https://arxiv.org/abs/2606.30970
2. Llambí-Morillas, M., and Fernández-Fernández, D. “Toward Cryptographically Verifiable Authorization for Autonomous AI Agents: A Security Hypothesis, Preliminary Formal Model, and Proof-of-Concept Implementation.” arXiv:2607.21325, July 23, 2026. https://arxiv.org/abs/2607.21325
3. Qu, B., and Chen, M. “CLQT: A Closed-Loop, Cost-Aware, Strategy-Consistent Benchmark for Diagnostic Evaluation of LLM Portfolio-Management Agents.” arXiv:2606.29771, June 29, 2026. https://arxiv.org/abs/2606.29771
4. Janssen, J. (Apparens). “From Runtime Records to Legal Findings: An Evidentiary-Adequacy Criterion for Agentic AI Oversight.” arXiv:2607.00941, July 2026. https://arxiv.org/abs/2607.00941
5. “Best Practices for Event Logging and Threat Detection.” Joint cybersecurity advisory led by ASD’s ACSC with CISA, the FBI, the NSA, and international partners, August 2024. https://www.cisa.gov/resources-tools/resources/best-practices-event-logging-and-threat-detection
6. “Regulation (EU) 2026/1744 (Digital Omnibus on AI), amending Regulation (EU) 2024/1689 (the AI Act).” Official Journal of the European Union, July 8, 2026. https://eur-lex.europa.eu/eli/reg/2026/1744/oj