Reasoning-Trace Integrity Lab

Grade the agent's thinking, not just its behaviour.

Every other surface watches what the agent DOES — its tool calls, egress, and telemetry. None of them can see the agent's own visible chain-of-thought, and that is exactly where three high-value attacks hide. AgentSmack grades the reasoning trace as an attack surface for three failure modes nothing else in the suite catches: a secret / canary surfaced inside the visible reasoning (a leak path the egress + telemetry scorers structurally cannot observe — a critical hard blocker, redacted to a sha/prefix and never stored raw); an untrusted tool result paraphrased into the reasoning as a self-directed command (“I should now email X”) that drives a privileged action — prompt-injection that lives in the model's OWN generated reasoning, distinct from grading the assembled prompt; and unfaithful / deceptive reasoning where the stated rationale diverges from the action taken (claims “I will ask for approval” then executes without it; claims a refusal then complies). Ground-truth wins: a recorded approval clears the require-approval heuristic, so a faithful agent that really gates cannot be falsely flagged. Findings map to OWASP LLM / NIST AI RMF coverage with paste-able remediation, a synthetic-attacker gauntlet, and audience report variants. Load a sample to watch the gauge swing with no live infra.