Build an AI undercover agent that produces admissible evidence

An undercover AI agent is operationally useful only when its output can be admitted as evidence. Set identity, custody, authentication, and legal scope controls before deployment.

Aslan, an AI-operatives startup, raised $20.8 million before public launch. The company gives the FBI and other intelligence-community users AI agents that pose as analysts in underground criminal forums. Aslan's clients have applied the tools to trace an active smuggling route along the U.S.-Mexico border, identify a cyber-fraud market avoiding sanctions, and reveal technology-transfer channels tied to Chinese government access to U.S. AI systems. Aslan has refused to apply its tools to domestic operations aimed at Americans and is concentrating on the U.S. market.

A chatbot can be rebuilt. A record cannot be reconstructed after the fact. Build a packet that a reviewer can open without asking the agent to explain itself. The client reviews the packet, not the agent.

Identity leaks are the first failure

The 1982 U.S. Intelligence Identities Protection Act criminalizes the intentional, willful revelation of a clandestine agent's identity without that person's consent. When CIA operative Valerie Plame's identity became public in 2003, the disclosure ended her career and put her family at risk. An AI persona is not a person, but the record around it can still expose a human source, a method, or a client. The operator must treat the persona as a protected asset.

Identity protection starts before the agent speaks. The persona needs a name, a role, a history, and a handler, but those details must not live only in the prompt. The prompt can be edited. The log cannot. If the persona is later challenged, show who approved it, when it was created, and who was allowed to see it.

The checklist is the product

A covert-agent operating checklist should be short enough to run before deployment and after every incident. Each item must be testable in a minute. The list below is the minimum set.

• Identity: the persona, credentials, and handler are logged before first contact, and the log is sealed.
• Custody: every capture, export, and transfer is timestamped and hashed, with the hash stored outside the agent runtime.
• Authentication: the model version, prompt, tool calls, and output are preserved as a replayable packet.
• Deepfake defense: the packet includes provenance metadata and a human review note explaining why the artifact is not synthetic fabrication.
• Scope: the mission states the target, jurisdiction, authority, and prohibited actions, and the agent stops when any boundary is crossed.
• Disclosure: the record identifies who may see the persona, who may disclose it, and what happens if disclosure occurs.

The first three items protect the artifact. The last three protect the mission. A reviewer should be able to open the packet, verify the hash, replay the run, and see the boundary that stopped the agent. If the reviewer cannot do that in a short session, the packet is too complicated to defend.

Admissibility is built before the first message

The 2026 Eighth Circuit ruling, U.S. v. Belt, 181 F.4th 931, illustrates the authentication problems that arise when evidence is disputed as a deepfake. Assume the defense will call the output synthetic. The packet must answer that challenge without a witness who can be discredited by the persona itself. Keep the human reviewer separate from the agent's identity. Store the hash chain outside the model. Keep the legal scope separate from the technical log.

Deepfake challenges are not only about video. A transcript, a screenshot, a forum post, or a model output can all be attacked as synthetic. Make the provenance obvious. Show the source of each artifact, the time it was captured, and the path it took into the case file.

Legal scope controls are the difference between a mission and a liability. Define what the agent may ask, what it may store, and what it may not do. The mission file names the authority, the target, the prohibited actions, and the stop condition. When the agent drifts, the log shows the drift and the halt.

If the packet cannot survive a challenge, the conversation creates exposure. Before launch, run the checklist, export the packet, and have a reviewer who did not build the agent try to break it. If any item fails, stop the mission and fix the record first.