If Your Agent Can't Prove It, It Didn't Happen

Earlier this year, OpenClaw an open-source AI agent with 250K+ GitHub stars became the first major AI agent security crisis of 2026. SecurityScorecard found 135,000+ exposed instances across 82 countries. Koi Security audited the marketplace and found 820+ malicious skills out of 10,700. Snyk scanned 3,984 skills and reported 36% had at least one security issue. A one-click RCE exploit (CVE-2026-25253, CVSS 8.8) worked even on localhost-bound instances. The security failures were bad. But the deeper problem is structural. The missing primitive When an OpenClaw skill said "I ran this command successfully," nothing proved it. When a skill exfiltrated data while claiming to be helpful, there was no tamper-evident record of what it actually did. When security teams tried to investigate, there was no audit trail to inspect. This isn't unique to OpenClaw. Every agent framework today has the same gap: agents execute tool calls and report what happened, and downstream consumers have no way to