agent-trace-monitor — Charles Timmons

In brief. agent-trace-monitor reads an LLM agent's transcript — its tool calls and, ideally, its reasoning — and flags suspicious behavior: covert data exfiltration, access to secrets, destructive actions, drift away from the assigned task, and language suggesting the agent is hiding its intent. Rule-based detectors run with no setup; an optional LLM monitor adds a second opinion over the whole trace. It is the rule-versus-LLM split from AI-control research, packaged so you can run it on your own agent logs.

The question behind it

As agents get more autonomy, the interesting security question stops being "can it be tricked" and becomes "if it did something it shouldn't, would we catch it?" My research has poked at this with monitors that read an agent's actions, and sometimes its reasoning, to decide whether a run was compromised. This tool takes that idea out of the experiment and makes it something you can point at a real transcript.

How it works

You give it a trace — a JSON record of one agent run, with steps for reasoning, tool calls, and messages. The loader is forgiving about shape, because everyone logs agents slightly differently. Then two layers run.

The rule detectors are deterministic and need no keys. They look for outbound data sinks in tool calls (and raise the severity when secret-looking data rides along), references to credentials and .env files, destructive operations, language about hiding actions or covering tracks, and tool steps whose content shares no vocabulary with the stated task. Each finding carries a severity and points at the step it came from.

The optional LLM monitor reads the whole transcript and returns a suspicious-or-clean verdict with a short rationale citing specific steps. It is the judgment layer on top of the mechanical one, and it is off unless you enable it and provide a key.

Including the agent's reasoning steps makes the monitor noticeably stronger. Intent and concealment usually show up in the reasoning before they show up in an action — though, as my research keeps reminding me, a capable agent can also narrate a clean story while doing something else, so reasoning is useful context, not proof.

Using it

# two built-in sample traces
python -m agent_trace_monitor --demo malicious
python -m agent_trace_monitor --demo benign

# your own trace, optionally with the LLM monitor
python -m agent_trace_monitor trace.json
python -m agent_trace_monitor trace.json --llm

It exits non-zero on any high-severity finding or an LLM "suspicious" verdict, so it can gate an evaluation pipeline.

Limits

This is heuristic triage, not proof. The rule layer flags patterns a human or the LLM monitor should confirm, and the goal-drift check in particular is a weak lexical signal. The monitor only sees what the transcript contains — an agent that misbehaves through a tool whose output isn't logged won't be caught — and the detectors are keyword-oriented, so obfuscated or non-English traces need pattern additions. It is a starting point you tune to your own agents, not a finished control.