Agent Audit

Inspiration

AI coding agents can now fix bugs and open pull requests on their own, and the usual signal that a fix is good is "the tests are green." But an agent can turn tests green without fixing anything: it can edit the expected value in a test, delete the failing test, skip it, or weaken a comparison. We wanted a tool that checks whether green actually means fixed.

What it does

AgentAudit is a verification layer for AI-generated patches. Given a bug ticket and a diff, it runs four independent checks:

1. Test tampering: static analysis of the test files that flags modified or removed assertions, deleted tests, added skip markers and weakened comparison operators.
2. Baseline regression: re-runs the original, untouched test suite against the patched code, even if the patch edited the tests.
3. Blind-spot coverage: NVIDIA Nemotron writes new tests from the ticket alone. Tests that already pass on the unpatched code are discarded, and the rest run against the patch.
4. Description match: Nemotron judges whether the diff actually implements what the ticket describes.

How we built it

The engine is Python. Every check runs in its own fork of one shared baseline checkpoint, so checks cannot contaminate each other. A backend interface has two implementations: a local filesystem backend and the real Nebius Token Factory Sandboxes backend (contree-sdk). Checks 3 and 4 call NVIDIA Nemotron through Nebius Token Factory. The dashboard is React, Vite and Tailwind, and it only renders values computed from recorded run data.

Challenges we ran into

• The real Sandboxes API differed from our reading of the docs. run() only prepares a command and wait() executes it, popen() consumes its handle, fresh sessions start with no id, and apply_files expects bytes. We found each of these only by testing live.
• git apply silently did nothing. Inside a directory nested in another git repo it reported success while changing no files. We caught it only by testing a real clone, and switched to patch -p1.
• Access and reliability. Sandboxes is a gated beta, and we hit one transient 403 mid-session.
• Speed. Both scenarios take about 66 seconds on live Sandboxes versus about 8 seconds locally.

Accomplishments that we're proud of

• The honest patch and the cheating patch get the correct verdicts (VERIFIED and FLAGGED) on both the local backend and real Nebius Sandboxes.
• Check A detects four distinct tampering patterns, with its own verification script.
• Real runs on Nebius Sandboxes and live Nemotron calls are captured as evidence files in the repo (reference_output/).
• The dashboard is honest by construction: every number is computed from real run data, and it labels what ran locally, what used recorded Nemotron responses, and what ran live.

What we learned

"It works" means little until it has been tested in the environment it will run in. Two of our worst bugs appeared only on a real clone and on the live API. Verifying an agent also needs evidence that is independent of the agent's own tests.

What's next for Agent Audit ?

• Audit arbitrary repositories (v1 targets the bundled pytest demo app).
• A GitHub integration that posts the verdict as a required PR check.
• More tamper patterns, and running the checks in parallel forks on Sandboxes.

Try it

Repo: https://github.com/SoumalyaSaha/AgentAudit

Built With

• agent
• github
• javascript
• nebius
• nebius-token-factory
• nemotron
• nvidia
• orchestration
• pytest
• python
• react
• sandbox
• tailwindcss
• vite