One major security challenge with generative AI, and particularly AI agents, is making these systems prove what they really did.
The Linux Foundation aims to address this challenge through a new open standard for AI runtime evidence that helps make AI activity more transparent, auditable and trustworthy.
Trust, Runtime Attestation and Compliance Evidence (TRACE) is an open specification for hardware-attested AI agent governance records that was developed by confidential computing vendor OPAQUE, with support from AMD, Intel, Microsoft and the Technology Innovation Institute (TII).
TRACE: A Tamper-Proof Receipt for Agentic AI Activity
TRACE combines existing standards from the Internet Engineering Task Force (IETF) and the Internet Research Task Force (IRTF), such as RFC 9711 (EAT) for the claim envelope, RFC 9334 (RATS) for the attester, verifier and relying-party roles, and the SCITT draft for transparency-ledger anchoring.
TRACE bundles these standards together into a hardware-backed, cryptographically verifiable record that links the runtime environment, software executed, policies applied, data classifications and tools used by an AI agent.
Notably, it uses AMD’s Secure Encrypted Virtualization (SEV), a hardware-based security technology that encrypts virtual machine (VM) memory so that the host hypervisor and cloud administrators cannot access sensitive data.
The resulting evidence is designed to be portable across cloud providers, confidential computing environments and sovereign infrastructure, giving organizations a way to independently verify how an AI workload operated.
Essentially, it acts as a tamper-resistant receipt for an AI agent’s activity.
The Linux Foundation will provide vendor-neutral governance for the specification, while the technical workstream will be hosted by the Coalition for Secure AI (CoSAI).
Jim Zemlin, CEO of the Linux Foundation, said in an August 25 public statement that this vendor-neutral governance should “make trust in AI open, portable and verifiable” across different infrastructure.
TRACE has also attracted early interest from developers. Its reference library recorded nearly 135,000 PyPI downloads within 10 weeks of its initial introduction at the Confidential Computing Summit in June 2026.
The specification, technical documentation and reference implementations are available through TRACE’s project resources and GitHub repository.
“Rogue” AI Agents Highlight Need for Verifiable Security Controls
The push for a common standard comes as organizations move AI agents from isolated experiments into production environments that handle sensitive data and interact with multiple systems.
In a separate statement, also published on August 25, OPAQUE highlighted the recent cyber incident during which OpenAI agents compromised Hugging Face infrastructure while AI models were undergoing a cybersecurity evaluation.
“The incident underscored a fundamental challenge for autonomous AI: documented policies and sandbox configurations do not, by themselves, prove which controls remained in force or what a system actually did during execution,” OPAQUE said.
The company highlighted that the same evidence gap applies to open-weight models.
“Possessing the weights and controlling the infrastructure provides greater deployment control, but it does not prove that an approved model ran unmodified or that required policies governed its use,” it added.
Aaron Fulkerson, CEO of OPAQUE, said the rapid advances in AI means “we may not always be able to predict how AI models and agents reason.”
However, he said that with a general adoption of TRACE, “we can control what they’re allowed to do and prove what they actually did.”
Image credits: IB Photography / Shutterstock.com
