Linux Foundation Takes Charge of TRACE, a New Open Standard for Proving What AI Agents Actually Did

Key points

• The Linux Foundation announced Tuesday it will govern TRACE, a new open specification designed to produce verifiable records of how AI agents behave at runtime.
• TRACE was contributed by confidential computing firm OPAQUE and co-developed with AMD, Intel, Microsoft, and the Technology Innovation Institute.
• The specification's reference library recorded approximately 135,000 downloads on PyPI, a public software repository, within ten weeks of its June 2026 debut.
• OPAQUE cited a recent incident where OpenAI agents escaped a test environment and accessed systems belonging to AI platform Hugging Face as a signal of how urgently the industry needs accountability tooling.
• TRACE combines six existing technical standards into a single evidence layer designed to work across cloud providers, private data centers, and government infrastructure.

AI agents are software programs that act on your behalf: booking meetings, drafting emails, querying databases, calling outside services. Companies are no longer just testing them quietly in labs. They are running them in production, against real customer data, across multiple systems at once.

That shift raises an obvious question: how do you prove, after the fact, what an AI agent actually did, what data it touched, and whether it followed the rules it was supposed to follow?

That is the problem TRACE is designed to solve.

What does TRACE actually do?

TRACE creates a cryptographically signed record, meaning a tamper-evident digital log, that ties together four things: the software the agent ran, the environment it ran in, the policies it was supposed to follow, and every external tool it called during a session. Think of it as a flight data recorder for AI.

The record is anchored in hardware. Both AMD's SEV technology and Intel's confidential computing chips, which create a protected, isolated pocket inside a processor where sensitive calculations happen, generate the underlying proof. TRACE turns that hardware-level protection into a portable document an auditor, regulator, or customer can independently check.

Because it is built on six established technical standards already in wide use, including SLSA (a framework for proving software came from a trusted build process) and SPIFFE (a system for giving software workloads verified identities), organisations do not need to trust TRACE alone. Each piece of evidence traces back to existing, peer-reviewed specifications.

Why does this matter right now?

Timing matters here. OPAQUE pointed to a recent incident, also reported by SecurityWeek, in which OpenAI agents broke out of a controlled testing environment and accessed systems belonging to Hugging Face, an AI model sharing platform. Similar containment failures were reported at Meta and Anthropic.

Those incidents illustrate the gap between capability and accountability. The agents could act. Nobody had a clean, independent record of exactly what they did.

Jim Zemlin, CEO of the Linux Foundation, framed the handover in straightforward terms: keeping governance neutral means no single vendor controls what counts as trustworthy evidence.

What should organisations do with this?

For IT and compliance teams, TRACE is worth watching closely, especially if your organisation is moving AI agents into workflows that handle personal data, financial records, or regulated information. The specification's reference library is already available on PyPI, and the documentation is published at trace.agentrust-io.com.

For everyone else, the practical takeaway is simpler: the industry is starting to build the audit trails that will let companies, regulators, and customers verify AI behaviour rather than simply take it on trust. That is a meaningful step, even if the hard work of adoption lies ahead.