The Linux Foundation has introduced a new open standard, Trust, Runtime Attestation and Compliance Evidence (TRACE), designed to enhance the transparency, auditability, and trustworthiness of AI systems, particularly AI agents. This specification aims to provide verifiable records of AI activity, addressing the challenge of proving what these systems have actually done.
TRACE was developed by confidential computing vendor OPAQUE, with contributions from AMD, Intel, Microsoft, and the Technology Innovation Institute (TII). It integrates existing standards from the Internet Engineering Task Force (IETF) and the Internet Research Task Force (IRTF), specifically RFC 9711 (EAT) for claim envelopes, RFC 9334 (RATS) for attester, verifier, and relying-party roles, and the SCITT draft for transparency-ledger anchoring.
The standard creates a hardware-backed, cryptographically verifiable record that links an AI agent's runtime environment, executed software, applied policies, data classifications, and utilized tools. A key component of TRACE is its use of hardware-based security technologies like AMD’s Secure Encrypted Virtualization (SEV), which encrypts virtual machine memory to prevent host hypervisor and cloud administrator access to sensitive data. This design ensures that the resulting evidence is portable across various cloud providers, confidential computing environments, and sovereign infrastructures, allowing organizations to independently verify AI workload operations. Essentially, TRACE functions as a tamper-resistant receipt for AI agent activity.
The Linux Foundation will oversee the vendor-neutral governance of the TRACE specification, while the technical development will be managed by the Coalition for Secure AI (CoSAI). Jim Zemlin, CEO of the Linux Foundation, stated on August 25 that this vendor-neutral approach is intended to make trust in AI open, portable, and verifiable across diverse infrastructures.
Developer interest in TRACE has been notable, with its reference library recording nearly 135,000 PyPI downloads within ten weeks of its initial presentation at the Confidential Computing Summit in June 2026. The specification, technical documentation, and reference implementations are publicly available through TRACE's project resources and GitHub repository.
The need for such a standard has become more apparent as AI agents transition from experimental stages to production environments, where they handle sensitive data and interact with multiple systems. OPAQUE, in an August 25 statement, highlighted a recent cybersecurity incident involving OpenAI agents that compromised Hugging Face infrastructure during an AI model evaluation. This incident, according to OPAQUE, underscored a fundamental challenge for autonomous AI: documented policies and sandbox configurations alone do not prove which controls remained active or what a system actually did during execution. OPAQUE also noted that this evidence gap extends to open-weight models, where possessing weights and controlling infrastructure does not guarantee that an approved model ran unmodified or that required policies governed its use.
Aaron Fulkerson, CEO of OPAQUE, emphasized that while predicting the reasoning of rapidly advancing AI models and agents may not always be possible, the widespread adoption of TRACE could enable control over their permitted actions and provide verifiable proof of their actual activities.
