AI agents can work a computer two ways: creating none of the records digital forensic examiners use to prove a person did something, or creating records that look like a person did it. Either way, the next courtroom excuse is already installed on ordinary computers.
The warning comes from Ovie Carroll, a SANS Institute principal instructor, co-author of its Windows forensic analysis course and director of the Justice Department’s cybercrime lab, writing in his personal capacity. In a new paper, he gives the excuse a name: SAIDI, short for “some artificial intelligence did it.” Attorneys have leaned on its ancestor for decades. SODDI, “some other dude did it,” is the argument that the Wi-Fi was open, the account was shared, the malware was responsible, anyone but the defendant was at the keyboard. The successor swaps the unknown human for the AI assistant the user installed themselves.
The paper is built on a controlled test. On a Windows 11 machine, Carroll placed a Word document in a OneDrive folder and instructed an AI agent, the open-source OpenClaw framework running Anthropic’s Claude, to open the document, add a summary paragraph and save it. The agent did the work. It just never worked the way a person would. Instead of opening Word, it rewrote the file through a programming library inside an invisible PowerShell session, the kind of silent process that runs with no window and no click. The document changed. The change synced to the cloud. Word launched afterward only to display the finished file.
The records Windows creates when a human opens a document, the shortcut files, the recent-documents lists, the registry entries examiners reach for first, were never created. An examiner relying on them would have reported the document was never opened. That conclusion would have been false, and Carroll ran the test to show how easily.
A File In Your Folder No Longer Proves You Touched It
Digital evidence disputes often come down to evidence of attribution, or who was at the keyboard. Employment cases turn on who copied the client list. Fraud investigations turn on who edited the invoice. For decades, examiners answered with the digital equivalent of footprints, the trail of records an operating system leaves behind when a person clicks through folders and opens files.
Some agents do not leave those footprints, because they do not walk through the front door, while a different agent might drive Word the way a person does and leave records that look human.
The reverse error is just as dangerous. A modified spreadsheet sitting in someone’s personal folder looks like proof of personal action. It may be the work of an assistant acting on a vague instruction, or on no instruction anyone remembers giving.
Carroll describes the two failure modes plainly: an examiner who finds no records and concludes nothing happened, and an examiner who finds a file and concludes the user made it. Innocent people can be blamed for what software did under their account. Guilty ones can point at the AI copilot their employer installed for them.
What Actually Answers ‘The AI Did It’
In Carroll’s test, the truth was recoverable. It was not where examiners usually look. The file system’s change journal recorded the rewrite to the second. The event log captured the silent PowerShell session. The agent kept its own session log, preserving the typed instruction verbatim. Three independent records, each created by a different system, told one consistent story.
Answering a SAIDI defense is after-the-fact device work: the change journals, event logs and agent session records that captured what actually ran. While the logs in Carroll’s test established that an instruction was given and that the agent carried it out, they did not establish who typed the instruction, or whether that person understood what the agent would do.
Courts Are Already Bracing For Machine-Made Evidence
The federal courts saw part of this coming, then hesitated. Proposed Federal Rule of Evidence 707 would hold machine-generated evidence to the same reliability standard as human expert testimony, and after mixed public comment the rules committee pulled it back for further study. Agent-attribution fights can reach courtrooms years before any rule is ready, and courts already struggle with ordinary digital evidence.
The agent itself will never explain any of it from the stand. Federal Rule of Evidence 603 requires every witness to swear an oath designed to bind the conscience, and software has no conscience to bind. Carroll’s line on this is the one worth remembering: without accountability there is no testimony, only output.
The agents are already here, reading files and drafting documents under ordinary user accounts on ordinary computers. Somewhere in that activity sits the first case that turns on whether a person or their AI agent touched a file. If the examiner stops at the missing footprints, the cost of the wrong answer lands on whoever needed the right one.
