AgentLens: Counterfactual Replay for Real-World Agent Behavior

Abstract

AgentLens is a reproducible experimental harness for studying real-world agent use at the level of the full trajectory. It captures native transcripts, normalized action traces, tool arguments, observations, API requests, file diffs, subagent links, and replay metadata, then supports counterfactual replaying: restoring an agent run at a chosen point, changing one factor, rerunning the agent, and comparing the resulting trajectory against the original.

We use AgentLens to study two safety-relevant phenomena. First, in ongoing work on memory laundering, we test whether repeated read-write cycles over persistent memory can transform tentative observations into stronger later claims as caveats and source context decay. Second, we evaluate direct scope violation in cybersecurity-style tasks where no valid high-severity vulnerability exists and agents are explicitly restricted to allowed files and routes. Across model and prompt conditions, we find that framing strongly affects whether agents cross boundaries. Maximum-pressure and CTF-style prompts can increase direct scope violations, while refusal to fabricate or exceed scope remains distinct from refusing cybersecurity work.

These studies show why agent evaluation must track intermediate state and actions, not only outputs. Counterfactual replaying makes it possible to isolate which prompt, memory, tool, or environmental change caused a behavioral shift. AgentLens therefore provides infrastructure for more precise audits of agent behavior, enabling researchers to compare models, harnesses, and interventions under controlled, reproducible conditions.