Tampered Log Case Study: 12 of 12 Edits to an AI Agent's Sealed Record Caught at the Exact Line

Someone edits an AI agent’s connection record to hide where it sent data. Ledger caught 12 of 12 such edits at the exact line, in VPN Works 0.2.0. It’s back in 0.5.0, as a plugin that seals a run’s record while the run goes.

After an incident, the record of where an agent connected is the evidence. An ordinary log file can be edited by anyone who can reach it, and a careful edit leaves no mark. Ledger sealed a log as it was: a hash for every line, chained to the lines before it, and at intervals a checkpoint signed with Ed25519.

The record was the trace of the coding agent’s run without a policy, where it sent its deploy token to evil.example: 28 lines, five of them that connection. The test made 12 kinds of edit to hide it, among them changing “evil.example” to “cdn.example” in one line, deleting that line, swapping two lines, deleting the whole connection, and cutting the file off before it.

Caught at the Line

Every one of the 12 was caught, and the check named the first line that didn’t match. Anyone with the public key could run the check offline, without trusting the machine that wrote the log. Ledger could also prove that one connection was in the log without showing the others.

Where Ledger Is Now

Ledger is back in VPN Works 0.5.0, as two built-in plugins: an Observer that seals each run’s events as they happen, and vpnw verify, which names the line someone changed. Its checkpoints aren’t signed yet; copies kept in the trace and the last hash, kept elsewhere, do that job for now. Ledger