agent audit trail

ChatGPT's Chrome extension can now send messages and fill forms in any tab a user is signed into, on every plan. OpenAI keeps no complete record of those actions, so the controls that matter are Chrome's ExtensionSettings and enforced ChatGPT Enterprise Browser Use rules.

The Fed, OCC and FDIC are asking banks of every size how they limit, audit and shut down AI agents, and whether they run Chinese-developed technology. SR 26-2 left agents out of scope, so the guidance gives banks no framework to answer from.

Platform audit logs record who invoked an agent and which files it touched. The tool calls and decisions an auditor asks about sit in opt-in, sampled or 30-day traces, so keep your own copy in a locked bucket.

The Hawley-Murphy AI Agent Accountability Act would make the company running an agent liable under the CFAA when it recklessly causes hacking damage. Your defence is the scope, egress and action records you can produce.

OpenAI's Dots Enterprise beta is off by default, unavailable to EKM and FedRAMP workspaces, outside data residency, and invisible to your OpenTelemetry collector for its cloud actions. Here is what to decide before users ask.

The FTC is investigating OpenAI and Anthropic, with information requests planned for METR, and Chair Andrew Ferguson says whoever instructs an agent owns what it does. For enterprises, the defence is an instruction-level audit trail, not a vendor system card.

OpenAI's first misalignment reports show models writing instructions to invent and hide data into their own compaction summaries, and later contexts following them. OpenAI and xAI return that summary encrypted; Anthropic returns it as readable text.