AI Agent Forensics

Scope

Examine task initiation, runtime state, visible planning records, memory, available tool permissions, execution attempts, and resulting changes. Some agents delegate to sub-agents or invoke tools through an intermediary. Each transition may have different identifiers, clocks, logging policies, and access constraints. Do not assume that a visible plan exposes all internal computation.

For a practical walkthrough, read the AI Agent Forensics guide, including evidence to preserve, action states, an email example, and common questions.

Why the field matters

An agent’s output can be an action as well as text. A task may change files, send an API request, browse a site, or trigger another process. Explaining the resulting artifact requires a record of which boundary was crossed, with which permissions, and what outcome the affected system recorded.

Evidence sources

• Task initiation, agent state, accessible planning and memory records, runtime configuration, and session identifiers.
• Tool descriptions, call arguments, results, MCP messages, API request identifiers, browser activity, shell commands, and exit status.
• Filesystem changes, before-and-after hashes, system logs, network records, authentication events, and external audit logs.
• Delegation records, parent and sub-agent task identifiers, permission grants, and credentials references handled as sensitive evidence.

Typical investigative questions

• Who or what initiated the task, and what authorization was recorded?
• Was a tool call attempted, accepted, completed, retried, or rejected?
• Which agent or sub-agent acted under which account and permission boundary?
• Do system logs and resulting artifacts support the reported outcome?
• Did an external effect occur after an interruption or outside the visible task interval?

Examination methods

Create an evidence graph linking task, agent, tool, external system, and artifact nodes. Preserve raw request and result records with their identifiers. Add authentication and permission context without publishing credential values. Correlate commands with process execution, file changes, and network evidence where those sources were acquired.

Record proposed actions, attempted actions, and confirmed effects separately. For delegated work, retain parent-child relationships and examine whether results were incorporated by the initiating agent. Treat retries and asynchronous completion as distinct events. MCP specifies tool-call semantics; implementations determine whether durable logs are kept and which fields are retained.

Corroborating evidence

A successful API response may be corroborated by an external audit event or resulting object. A shell transcript can be checked against process and file records; a browser action against destination-side evidence where authorized. Sources controlled by the same agent runtime share failure risks. Explain when independent corroboration was unavailable.

Common failure modes

• Taking “completed” in a generated summary as independent proof of execution.
• Losing request identifiers while flattening multiple tool calls into prose.
• Attributing a sub-agent action to a human without showing the delegation chain.
• Treating tool permissions as evidence that every permitted action occurred.
• Publishing secrets contained in arguments, logs, or authentication traces.

Limitations

Transient state, partial logging, asynchronous tasks, remote execution, and clock differences can break continuity. A tool result can report success before the external effect is durable. A credential identifies an access mechanism; it does not by itself establish who controlled the initiating session. Historical agent behavior may not be reproducible after tool or model changes.

Reporting cautions

Describe the exact action boundary and level of confirmation. Report “a call requested a file write” separately from “the acquired filesystem contained the resulting bytes.” Identify gaps in the delegation and authentication trail. Include timeline uncertainty and redact sensitive credentials while preserving the unredacted evidence through appropriate controls.

Did the agent actually create the file?

Locate the task, tool request, reported result, and relevant filesystem or service records. Match identifiers and inspect the resulting object where authorized. Record dispatch and completion separately, especially when the tool returned a job identifier or timed out before an external change finished.

Conclude at the level supported: the action was suggested, requested, reported, or independently corroborated. A successful command status can be relevant while still leaving the expected file contents or final external state unverified.

Related fields & glossary terms

• Interaction Forensics
• AI Artifact Forensics
• Model Forensics

Apply the examination methods, inspect the evidence classes, and check relevant external standards and specifications.