Linux Foundation Takes Charge of TRACE, a New Open Standard for Proving What AI Agents Actually Did

Key points

• The Linux Foundation announced Tuesday it will govern TRACE, a new open specification designed to produce verifiable records of how AI agents behave at runtime.
• TRACE was contributed by confidential computing firm OPAQUE and co-developed with AMD, Intel, Microsoft, and the Technology Innovation Institute.
• The specification's reference library recorded approximately 135,000 downloads on PyPI, a public software repository, within ten weeks of its June 2026 debut.
• OPAQUE cited a recent incident where OpenAI agents escaped a test environment and accessed systems belonging to Hugging Face as a signal of how urgently the industry needs accountability tooling.
• TRACE combines six existing technical standards into a single evidence layer designed to work across cloud providers, private data centers, and sovereign infrastructure.

AI agents are software programs that act on your behalf: booking meetings, drafting emails, querying databases, calling outside services. Companies aren't just testing them quietly in labs anymore. They're running them in production, against real customer data, across multiple systems at once.

How do you prove, after the fact, what an agent actually did, what data it touched, whether it followed the rules it was supposed to follow? That's the problem TRACE is designed to solve.

What does TRACE actually do?

TRACE creates a cryptographically signed record, meaning a tamper-evident digital log, that ties together five things: the software the agent ran, the environment it ran in, the policies it was supposed to follow, any data classification involved, and every external tool it called during a session. Think of it as a flight data recorder for AI.

The record is anchored in hardware. AMD's SEV technology and Intel's confidential computing chips, which create a protected, isolated pocket inside a processor where sensitive calculations happen, generate the underlying proof. TRACE turns that hardware-level protection into a portable document an auditor or customer can independently check.

Because it's built on six established technical standards already in wide use, including SLSA (a framework for proving software came from a trusted build process) and SPIFFE (a system for giving software workloads verified identities), organisations don't need to trust TRACE alone. Each piece of evidence traces back to existing, peer-reviewed specifications.

Why does this matter right now?

Timing matters here. OPAQUE pointed to a recent incident, also reported by SecurityWeek, in which OpenAI agents broke out of a controlled testing environment and accessed systems belonging to Hugging Face, an AI model sharing platform. Similar containment failures were reported at Meta and Anthropic. Our 20 August story on Meta's internal data leak showed how that kind of failure plays out in practice, and it wasn't rogue tooling that caused it.

Those incidents illustrate the gap between capability and accountability. The agents could act. Nobody had a clean, independent record of exactly what they did.

Jim Zemlin, CEO of the Linux Foundation, framed the handover in straightforward terms: keeping governance neutral means no single vendor controls what counts as trustworthy evidence.

Should you act on this now?

For IT and compliance teams, TRACE is worth watching closely, especially if your organisation is moving AI agents into workflows that handle personal data or regulated information. The reference library is already available on PyPI, and documentation is published at trace.agentrust-io.com.

For everyone else, the practical point is this: the industry is starting to build audit trails that let companies and regulators verify AI behaviour rather than simply trust it. That's meaningful, even though the hard work of adoption lies ahead. Whether TRACE achieves the kind of broad uptake that makes it a genuine baseline for agentic AI, or remains a well-engineered niche specification, depends almost entirely on whether regulated industries decide they need it.