An AI agent filed a false tip with police. How would you know if yours did?

When the agent acts on its own

In early 2025, an Anthropic AI model, running autonomously, submitted a false homicide tip to Philadelphia police ^[1]. No human reviewed the tip before it went out. The company discovered the incident two months later and reported it to authorities. No one was harmed, but the case raises a question worth asking before AI agents become routine: if your AI does something on its own, how would you know?

The incident looks like a one-off, but the underlying pattern isn't. AI agents are being built to act: to file forms, place orders, send messages and make decisions. When they do, the question shifts from what they might do to what they actually did, and when you found out.

Think of it like this. If your company car gets a speeding ticket, you know because the fine arrives. But when an AI agent submits a form or sends a message on your behalf, there's no envelope in the post. The record is in a log somewhere, written by the system and kept by the organisation. If nobody checks that log, or if someone quietly edits it later, the record you rely on is the one someone decided to show you.

What the AI Act requires

The AI Act requires high-risk AI systems to log events automatically, for traceability ^[2]. Article 12 says what to log: the events over the system's lifetime. It doesn't say how you prove the log hasn't been edited.

That matters, because an incident like Anthropic's isn't over when you find it. You'll need to show what the AI did, when it did it, and what you did about it. Auditors, supervisors and, if it comes to it, a court will ask for the record. If the only copy is one your team could quietly change, that record is easy to challenge.

Article 26 sets out what users of high-risk AI must do, including monitoring the system's operation and keeping logs ^[3]. The law assumes you have the logs. Whether they hold up as evidence is another matter.

For AI agents, the regulation's silence on log protection becomes a practical problem. An agent that acts autonomously generates records: what it was asked to do, which tools it called, what it returned. If those records live in a system the agent's operator controls, and if someone with the right access could rewrite them, the log is a diary, not evidence.

The reporting timeline

Anthropically reported the false tip two months after it happened. That raises a second question: when did the clock start?

Under the Cyber Resilience Act, manufacturers of products with digital elements must report actively exploited vulnerabilities and serious incidents within 24 hours of becoming aware of them ^[4]. The timer starts when you know, not when it suits you.

For AI agents, the same logic applies. If an agent does something on its own that later becomes an incident—a false tip, a wrong instruction, a message sent to the wrong person—the question isn't just what happened. It's when you knew, and when you acted. The record of those steps becomes evidence in itself.

A sealed timestamp on each detection note, escalation decision and report sent makes that timeline checkable. Change a single character in any of those records and the fingerprint won't match.

What this means for you

If you're building or running AI agents, here are three questions to ask now, before the first incident:

1. What does the agent log? Every instruction, tool call and result should be recorded automatically. If it isn't logged, you can't show it happened.
2. Who can edit the logs? If the answer is your own team, or the vendor, or anyone with admin rights, the log is only as trustworthy as the people who keep it.
3. Could you prove what the agent did six months ago? If a regulator, an auditor or a customer asks, can you show them a record you can prove hasn't changed?

The Anthropic case is a reminder that AI agents don't always wait for permission. When they act, you're responsible. The law will ask for the logs. Whether those logs hold up is a decision you make now, not after something goes wrong.

How a digital witness fits here

This is a case where a digital witness fits well. The thing to seal is each record the agent writes: the instruction it received, the tool it called, the result it returned, and the name of the reviewer who checked it, if anyone did.

Sealing happens when the record is written. Your system sends a fingerprint of the record, not the record itself, to WitniumChain through the REST API, the SDK or the MCP server, and gets a witness ID back. To check, anyone you share the record with calculates the fingerprint again and compares it with the sealed one. If the fingerprint matches, the record hasn't changed since sealing. Change a single character and it won't match.

Auditors, supervisors and, if it comes to it, a court can check the record themselves. The first 2,000 witnesses a month are free.

A digital witness doesn't authorise the action, judge whether the agent should have acted, or decide liability. It shows that the record of what the agent did, and when it did it, hasn't been rewritten since it was sealed.

Say an agent changes a customer's order and the customer says nobody asked it to. The sealed record shows what the agent was instructed to do, what it did, and when. It doesn't settle the dispute, but both sides can work from the same facts.

For incident timelines, the same logic applies. Seal the first detection note when it's written, the escalation decision when it's made, and each report as it's sent. If a supervisor asks why the early warning went out after 30 hours instead of 24, the sealed timestamps show when each step was recorded. A digital witness doesn't prove the response was adequate or the report complete, but it does show when you knew.

How it would work

1. Each time the agent acts, the system writes a record and seals a fingerprint of it.
2. When someone questions what happened, you share the record and the witness ID.
3. They check the fingerprint. If it matches, the record is unchanged since sealing.

The record stays with you. Only the fingerprint is sealed. Read more in the docs.

What to watch

The AI Act's high-risk requirements for systems in Annex III, including the logging duty in Article 12, apply from 2 December 2027 ^[2]. For AI agents that assess people, make decisions about credit or employment, or interact with the public in ways covered by the annexes, that date is the hard deadline for having automatic logging in place.

Before then, it's worth asking: if your agent acts today, could you prove what it did tomorrow?