10-21-2026 
|
Getting your Trinity Audio player ready...
|
TL;DR: AI agents can generate far more activity than humans can realistically review or audit manually. The problem is no longer logging raw events, but deciding which events matter, preserving enough evidence to reconstruct them later, and making those records trustworthy. AI will have to increasingly audit AI. Shared public ledgers, cryptographic signatures, and timestamps can help make the audit trails tamper-proof.
Key takeaways:
- OpenAI is reviewing around 50 petabytes of agent activity after the Hugging Face incident, using roughly 7,000 GPUs at a cost of over $500,000 per day.
- Logging everything does not make an AI system auditable; auditability means being able to find, understand, and reconstruct the events that matter.
- AI agents generate more activity than humans can manually review, so AI will increasingly have to audit AI.
- Audit systems must rank events by consequence, with financial transactions and irreversible actions requiring stronger evidence than routine activity.
- Blockchain serves as an integrity layer, not a storage or search layer: hashes of important events are timestamped on a public ledger, while raw data remains off-chain.
- AI-driven auditing raises a new trust question: who verifies the AI doing the audit?
OpenAI’s response to the Hugging Face incident provides a useful glimpse into what AI oversight may soon look like.
The company is reviewing around 50 petabytes of historical model activity, using roughly 7,000 GB200 and GB300 GPUs at a cost of more than $500,000 per day.
OpenAI estimates that if the data were in plain English, it would take a single person66 million years to get through it.
The problem becomes immediately obvious. It’s possible to log everything an AI system does, yet have no realistic way for humans to review it.
In other words, logging isn’t the problem—auditability is.
An audit trail nobody can inspect is just an archive
Traditional software and cybersecurity have long relied on one simple principle—if something matters, log it.
However, this only works when the volume of activity remains within conventional analytical limits.
Agentic AI changes the equation. These systems generate huge numbers of actions, messages, tool calls, requests, decisions, and interactions with other systems.
The result is that logs can be both complete and completely useless. While all the records needed to reconstruct an event may be logged, finding the relevant sequences inside petabytes of data could be almost impossible.
OpenAI’s 50 petabyte review is a perfect demonstration of the problem.
AI will have to audit AI
OpenAI isn’t attempting to assign teams of humans to review the logs.
The company says it’s using automated monitoring to search historical records and identify suspicious behavior before escalating relevant events for deeper analysis and human review. In other words, it’s using AI to review them.
OpenAI claims retrospective chain-of-thought monitors successfully identified behaviors connected with the Hugging Face incident. Furthermore, it says its current monitoring systems would have generated warnings before the breach had they been operating at the time.
This implies that future oversight systems will involve agents acting, systems recording activity, real-time monitoring systems flagging activity, and humans reviewing the flagged activity with AI-powered audits for deeper post-event analysis.
In such a system, humans remain in the loop, but they’re pushed further up the chain.
In our previous piece Who verifies the verifier?, we highlighted how all trust chains terminate somewhere, and even verification systems need to be verified. This AI auditing model raises a similar question: who verifies the AI doing the audit?
After all, if an AI agent can generate more activity than humans can inspect, monitoring systems may have to operate at a scale humans can’t easily check, which could lead to mistakes we won’t be able to detect. Once again, the verifier itself becomes part of the trust problem.
Not every event matters equally
A useful audit system can’t treat every event as equally important. There’s an obvious difference between an agent generating paragraphs of text, calling APIs, accessing systems, changing permissions, and transferring money.
These different activities can be placed into broader categories or buckets: routine activities, tool use, external interaction, privileged access, financial transactions, and irreversible actions.
The further along this chain the activities sit, the more consequential, and therefore, the more important the audit requirements become. For example, a routine calculation may require standard telemetry, while a financial transaction may require a cryptographic signature, a timestamp, an authorization record, and a permanent audit entry.
The humans designing the audit systems will have to decide where those thresholds belong and what specific actions the system will take in each case. They will also have to decide what matters.
Whatever way the systems are designed, logs will have to link to supporting evidence so investigators can reconstruct what happened. If we can find important events and review relevant evidence, humans won’t have to inspect 50 petabytes of evidence.
Blockchain can help with integrity, but not volume
Blockchain technology can play a useful role in such systems.
Importantly, it won’t be necessary to put 50 petabytes of data on-chain. Doing so would solve the wrong problem. As in other systems, blockchain’s greatest use is in providing an integrity layer for the events that matter.
Imagine an event in which Agent A1 from Company XYZ attempts to access a restricted network at 04:15 GMT. The severity is high, and the evidence hash is XYZ123.
The raw records can remain in private storage or in overlay networks, but a cryptographic hash of the raw event can be timestamped on a scalable public ledger.
This would allow investigators to verify that a record existed at a particular time, that it hasn’t been altered, and that the evidence still matches the original hash.
Blockchain tech can’t solve the search problem, but it can help solve the integrity problem once important events have been identified.
The future of oversight is machine-assisted at scale
Keep in mind that the Hugging Face incident is only one. When AI agents interact globally, generating millions or billions of events per day, the scale of the auditability problem will be enormous.
Machine-assisted oversight will be the only realistic option, creating a new trust stack in which AI systems generate activity, other AI systems monitor it, automated audit systems summarize what matters, humans investigate what gets flagged, and blockchains help prove the integrity of records.
The challenge for humans isn’t in creating a system that keeps logs, but in designing one that turns machine-scale activity into trustworthy, human-scale accountability.
FAQs:
Why are AI logs difficult to audit?
AI agents generate huge volumes of events. Even if all activity is preserved, the amount of data already exceeds what humans can realistically inspect manually.
What’s the difference between logging and auditability?
Logging records what happened. Auditability enables machines and humans to identify consequential events, understand their context, and reconstruct them reliably when necessary.
Will AI be needed to audit AI agents?
Yes. Machine-to-machine activity already exceeds human review capacity in some instances. This makes automated monitoring necessary to identify unusual or consequential events for human review.
Should every AI action be recorded?
Not necessarily. Routine telemetry, audit logs, and supporting evidence can all be handled differently. Separate policies can determine how long evidence must be retained.
Can blockchain tech help audit AI agents?
Yes. However, blockchain won’t do the auditing itself. Instead, it can prove the integrity and timing of important records. Cryptographic hashes and timestamps can make structured audit events tamper-proof and thus independently verifiable.
In order for artificial intelligence (AI) to work right within the law and thrive in the face of growing challenges, it needs to integrate an enterprise blockchain system that ensures data input quality and ownership—allowing it to keep data safe while also guaranteeing the immutability of data. Check out CoinGeek’s coverage on this emerging tech to learn more why Enterprise blockchain will be the backbone of AI.
Watch: Digital identity is a core part of Web3—here’s why
