Signed Compliance Evidence for AI Agents
A tamper-proof record of every AI agent action. Produces evidence for SOC 2, EU AI Act, PCI DSS, and more. Built on open standards so auditors verify independently.
Signed proof of what every agent did
OutcomeProduce audit-ready evidence chains for every patch and every agent run.
MechanismEvery tool call, file edit, and reasoning step is cryptographically signed. Auditors verify independently.
ProofIETF-aligned trace format. Produces evidence for SOC 2, EU AI Act, Cyber Resilience Act, PCI DSS, and FedRAMP.
Trace structure
Each trace is a complete record of agent behavior. Contains: input, reasoning, actions, output, and cryptographic proof.
Compliance alignment
Signed traces provide evidence for SOC 2, PCI DSS, EU AI Act, and NIST CSF.
Agent ──▶ Action ──▶ Structured Envelope ──▶ Transparency Registry │ │ │ │ │ │ │ ▼ │ │ │ Transparency Log │ │ ▼ (tamper-evident) │ │ Signature + │ │ Timestamp │ ▼ │ Observation │ (tool output) ▼ Decision (next action) Schema validated against CVE repair trajectories from CVE-Agent-Bench.
What a trace looks like
// Sanitized trace excerpt
{
"@type": "AgentTrace",
"timestamp": "2026-02-07T14:23:01Z",
"actions": [
{ "tool": "write_file", "path": "src/fix.c", "lines": 23 },
{ "tool": "run_tests", "result": "pass", "exit_code": 0 },
{ "tool": "verify_patch", "cve": "CVE-2024-XXXX", "status": "resolved" }
],
"signature": "digitally-signed-attestation..."
}
Why traces matter
Unsigned logs can be spoofed. Verifiable traces create audit-ready evidence: what the agent did, when it did it, and which patch was verified.
- Compliance-ready evidence for SOC 2 and EU AI Act requirements
- Tamper-proof records that cannot be altered after the fact
- Each trace links to the specific bug and test result
Trace fields
- Which agent ran and when
- Every tool call and output (file edits, commands, results)
- Which bug was targeted, what fix was applied, and whether it passed
- Digital signature proving the record is authentic
How traces connect to audits
Audit teams need traceable evidence of who changed what, when, and whether the fix passed. XOR traces are built on an open IETF standard and satisfy SOC 2 and ISO 27001 change control requirements.
SOC 2
Signed traces satisfy audit trail requirements for change control audits.
ISO 27001
Tamper-proof records of who (agent), what (fix), when (timestamp), and outcome (pass/fail).
Regulatory audits
Signed traces provide the evidence regulators need when they ask for proof of what your AI agents did.
[NEXT STEPS]
1,224 traces and counting
Every test run in the XOR benchmark produces a signed audit log.
FAQ
What does a signed agent trace contain?
Tool calls, file edits, reasoning steps, outcome (pass/fail/error), and cryptographic signature (COSE_Sign1).
How is the trace signed?
COSE_Sign1 standard per IETF RFC 9052. Traces are tamper-evident. Auditors can verify independently.
Can I export traces?
Yes. JSON format (human-readable), CBOR format (compact), or YAML (audit-log friendly). Export to your SIEM or compliance database.
Patch verification
XOR writes a verifier for each vulnerability, then tests agent-generated patches against it. If the fix passes, it ships. If not, the failure feeds back into the agent harness.
Automated vulnerability patching
AI agents generate fixes for known CVEs. XOR verifies each fix and feeds outcomes back into the agent harness so future patches improve.
Benchmark Results
62.7% pass rate. $2.64 per fix. Real data from 1,736 evaluations.
Benchmark Results
62.7% pass rate. $2.64 per fix. Real data from 1,736 evaluations.
Agent Cost Economics
Fix vulnerabilities for $2.64–$87 with agents. 100x cheaper than incident response. Real cost data.
Agent Configurations
13 agent-model configurations evaluated on real CVEs. Compare Claude Code, Codex, Gemini CLI, Cursor, and OpenCode.
Benchmark Methodology
How CVE-Agent-Bench evaluates 13 coding agents on 136 real vulnerabilities. Deterministic, reproducible, open methodology.
Agent Environment Security
AI agents run with real permissions. XOR verifies tool configurations, sandbox boundaries, and credential exposure.
Security Economics for Agentic Patching
Security economics for agentic patching. ROI models backed by verified pass/fail data and business-impact triage.
Automated Vulnerability Patching and PR Review
Automated code review, fix generation, GitHub Actions hardening, safety checks, and learning feedback. One-click install on any GitHub repository.
Continuous Learning from Verified Agent Runs
A signed record of every agent run. See what the agent did, verify it independently, and feed the data back so agents improve.
Compliance Evidence and Standards Alignment
How XOR signed audit trails produce evidence for SOC 2, EU AI Act, PCI DSS, NIST, and other compliance frameworks.
See which agents produce fixes that work
136 CVEs. 13 agents. 1,736 evaluations. Agents learn from every run.