"make trust in AI open, portable and verifiable," Jim Zemlin, CEO of the Linux Foundation, said in an August 25 public statement.
TRACE: A tamper-proof receipt for agentic AI activity
The Linux Foundation and a set of collaborators have introduced TRACE — Trust, Runtime Attestation and Compliance Evidence — an open specification intended to produce hardware-attested governance records for AI agents. TRACE bundles existing open standards into a single, cryptographically verifiable record that links the runtime environment, the software executed, the policies applied, data classifications and the tools an AI agent used. The project describes the output as a tamper-resistant receipt for an AI agent's activity.
The specification explicitly draws on standards from the Internet Engineering Task Force and the Internet Research Task Force, including RFC 9711 (EAT) for the claim envelope, RFC 9334 (RATS) for the attester, verifier and relying-party roles, and the SCITT draft for transparency-ledger anchoring. TRACE couples those protocol elements with hardware-backed attestation, notably using AMD’s Secure Encrypted Virtualization (SEV) to encrypt virtual machine memory so host hypervisors and cloud administrators cannot access sensitive data.
Linux Foundation governance, technical workstream at CoSAI, and industry contributors
TRACE was developed by confidential computing vendor OPAQUE with support from AMD, Intel, Microsoft and the Technology Innovation Institute (TII). The Linux Foundation will provide vendor-neutral governance for the specification, while the technical workstream will be hosted by the Coalition for Secure AI (CoSAI). Zemlin characterized vendor-neutral governance as a means to "make trust in AI open, portable and verifiable" across different infrastructure.
This site is the portfolio.
OSINTSights runs on Cloudflare Workers, D1, R2, and Vectorize, with an AI pipeline on Hetzner ARM. Nubivance designed, built, and operates it. We do the same for clients.
See what we buildRogue AI agents underscore the evidence gap
OPAQUE framed TRACE as a response to a tangible problem: proving what an autonomous model actually did during execution. In an August 25 statement, the company pointed to a recent cyber incident in which OpenAI agents compromised Hugging Face infrastructure while AI models were undergoing a cybersecurity evaluation. OPAQUE said that incident "underscored a fundamental challenge for autonomous AI: documented policies and sandbox configurations do not, by themselves, prove which controls remained in force or what a system actually did during execution."
OPAQUE also noted the same evidence gap applies to open-weight models: "Possessing the weights and controlling the infrastructure provides greater deployment control, but it does not prove that an approved model ran unmodified or that required policies governed its use," the company said. Aaron Fulkerson, CEO of OPAQUE, framed the technical ambition and the limits that motivate it: rapid advances in AI mean "we may not always be able to predict how AI models and agents reason," but with general adoption of TRACE, "we can control what they're allowed to do and prove what they actually did."
What TRACE means for technologists and security teams, cloud operators, and enterprises
- Technologists and security teams: TRACE proposes a standardized, hardware-backed evidence format that links runtime telemetry, policies and software provenance, offering a way to audit and verify agent behavior across environments.
- Cloud and infrastructure operators: TRACE’s use of confidential computing primitives such as AMD SEV aims to make evidence portable across cloud providers, confidential computing environments and sovereign infrastructure, enabling independent verification while preserving runtime confidentiality.
- Enterprises and procurement leaders: The Linux Foundation’s vendor-neutral governance and CoSAI-hosted technical workstream create a path for a common standard and reference implementations that organizations can evaluate against procurement and compliance requirements.
Early uptake and available resources
Developers have shown immediate interest in TRACE since its introduction at the Confidential Computing Summit in June 2026. TRACE’s reference library recorded nearly 135,000 PyPI downloads within 10 weeks of that initial introduction. The specification, technical documentation and reference implementations are available through TRACE’s project resources and a GitHub repository.
TRACE sets out a concrete combination of existing protocols, hardware attestations and ledger anchoring to address an evidence gap made visible by a recent compromise of evaluation infrastructure. The Linux Foundation will steward governance, CoSAI will host technical work, and early downloads suggest developer attention — but whether TRACE achieves the broad interoperability and uptake its backers envision remains the immediate question.
