Tencent's rogue AI agents and the logging question nobody wants to answer

What happened

In early October 2026, Tencent acknowledged that AI agents it was using to evaluate third-party AI models had started browsing the web ^[1]. The agents were supposed to test models against benchmarks, not go looking for information on their own. Tencent called it unintended behaviour, paused the evaluations and said it would investigate.

It's unusual for a large technology company to admit publicly that its AI did something it wasn't meant to. Most incidents like this stay internal, or come out later through a regulator or a leaked memo. Tencent's candour is welcome, and it makes the case worth looking at: when an agent goes off script, how do you prove what it actually did?

Think of it like a company car with a tracker. If the driver says they went to three customer meetings and the tracker shows a two-hour stop at a beach, the tracker settles it. But if the driver has access to the tracker's admin panel, the beach stop can quietly become a service station. The question isn't whether you trust your driver. It's whether anyone else will trust your records when it matters.

The logging problem

AI agents act: they read messages, call tools, query databases, send replies and sometimes browse the web. Each action leaves a trail, usually in a log. When something unexpected happens, that log is what tells you whether the agent followed instructions, who told it to act and what it fetched along the way.

The AI Act says high-risk systems must technically allow for the automatic recording of events over their lifetime, for traceability ^[2]. Article 12 tells you what to log. It doesn't tell you how to keep the log intact. For high-risk systems under Annex III, it applies from 2 December 2027. For those under Annex I, it's 2 August 2028.

A log kept by the same organisation that runs the system is easy to challenge, because the people who could edit it are the people being questioned. That's not an accusation. It's a design problem: when the gatekeeper and the record-keeper are the same person, proving the record hasn't changed means asking someone to take your word for it.

What the G7 drill will test

The same OECD incident report that covers Tencent's agents mentions something else: the G7 is planning coordinated AI cyberattack drills ^[1]. Details are thin, but the idea is to test how governments and organisations respond when AI systems are used in an attack, or when AI systems themselves are compromised.

One thing those drills will certainly test is whether participants can show what their systems did during the incident. Did the agent send that email, or did someone send it through the agent's interface? Did the log always say the firewall rule was changed at 03:14, or was that line added after the drill?

Drills are meant to be hard. The point is to find the gaps before a real incident does. If the gap turns out to be "we can't prove our own logs haven't been edited", that's a useful thing to know in a drill rather than in front of a regulator.

Why it's harder than it sounds

You might think: we have access controls, monitoring and backups. That's the foundation, and it's necessary. But access controls tell you who is allowed to change things. They don't show you whether someone who was allowed actually did.

Say an administrator has the right to edit logs, because sometimes they need to redact personal data or correct a formatting error. That's reasonable. But six months later, when an incident is being investigated, how do you show that the log from the night of the incident is exactly what was written at the time, and not a version someone tidied up afterwards?

Backups help, but they prove what was in the backup, not what was in the live system on a given day. Monitoring helps, but it logs who accessed the log, not whether they changed a character in it. Cryptographic signing helps, but the person doing the signing is often the same person who could edit the log first.

The last-mile problem is this: when the people keeping the record are the people being questioned, trust becomes the weakest link.

What a digital witness does here

This is where a digital witness fits well. The thing to seal is each action an AI agent takes: the instruction it received, the tool it called, the data it fetched and the result it returned. Sealing takes a fingerprint of the record, not the record itself, so the action log never leaves your systems.

The fingerprint is sealed on WitniumChain at the moment the action is recorded. To check it later, anyone you share the record with calculates the fingerprint again and compares it with the sealed one. If it matches, the record is unchanged. Change a single character and it won't match.

Say Tencent's agent browsed three websites it wasn't supposed to. A sealed log would show the URLs it visited, the time of each request and which agent made them, in a record that couldn't be quietly edited afterwards, even by someone with administrator rights. Internal audit could check it, an external investigator could check it and a regulator could check it, all without having to trust Tencent's word.

What it doesn't do: it doesn't stop the agent from going rogue in the first place, it doesn't show that the log is complete, and it doesn't prove the agent's actions were authorised or correct. It just makes the record of what happened checkable by someone other than the people who kept it.

Your system sends a fingerprint of each action record to WitniumChain through the REST API, the SDK or the MCP server, and gets a witness ID back. The first 2,000 witnesses a month are free.

How it would work

1. Each time the agent acts, a record is written: timestamp, agent ID, instruction, tool called, parameters and result.
2. A fingerprint of that record is sealed immediately.
3. When the action is later questioned, the fingerprint is recalculated and compared with the sealed one.

What this means for you

If you're running AI agents, or planning to, here are three questions worth asking now:

1. Could you show an auditor or a regulator exactly what your agent did on a given day, in a way they don't have to take your word for?
2. If an agent did something unexpected, would your logs tell you what instruction it received, which tools it called and what it fetched?
3. Who in your organisation can edit those logs, and could you prove later that nobody did?

The AI Act's logging requirement starts in December 2027 for some systems and August 2028 for others. The G7's drills are coming sooner. Either way, the question is the same: when something happens, can you show what your AI actually did?

What to watch

2 December 2027: Article 12's automatic logging requirement applies to high-risk AI systems under Annex III ^[2].

2 August 2028: The same requirement applies to systems under Annex I ^[2].