Agent telemetry in OpenTelemetry gives security teams usable evidence

At a glance

What this is: TENZIR argues that OpenTelemetry export turns agent harness activity into usable security evidence, including approvals, tool calls, command output, and permission decisions.

Why it matters: This matters because security teams cannot govern agentic work if the evidence stays trapped in local transcripts, opt-in fields, or partial observability points.

Context

Agent telemetry is the record of what an AI agent did, what it tried to do, and who or what approved it. In this article, the security gap is not that the signals do not exist, but that they are scattered across local files, model APIs, MCP servers, and optional export settings. That makes governance of agentic AI a collection problem before it becomes a detection problem.

For IAM and NHI teams, the important point is that agent activity behaves like machine identity activity with a decision trail. The article shows that commands, approvals, sandbox outcomes, and tool interactions can all be captured, but only if the harness, exporter, and downstream pipeline are configured to preserve them. That is a typical failure mode in early agent deployments.

Key questions

Q: What should security teams do first when AI agents start running commands and calling tools?

A: Start by turning on central telemetry export for the harnesses that can execute actions, then verify that approvals, tool calls, and session identifiers arrive in a collector you actually monitor. If you only keep local transcripts, you will miss the evidence needed for review, investigation, and containment.

Q: Why does partial agent telemetry create governance risk?

A: Because local session files, model APIs, and MCP servers each see only part of the activity, no single source can reliably prove what the agent touched or who allowed it. Without correlated evidence, access review becomes guesswork and incident reconstruction loses attribution.

Q: How do security teams know whether agent telemetry is actually working?

A: Telemetry is working when it captures tool calls, lifecycle events, and message traces in a way that supports investigation and correlation. If logs omit tool execution or are easy to alter, the control has failed. Durable output with redaction and forwarding to monitoring systems is the practical test.

Q: What happens if prompts or command arguments are exported without filtering?

A: Sensitive content can leave the machine and land in systems that were never intended to hold it, including security platforms, archives, or downstream analytics. Teams should classify those fields up front and apply redaction or hashing before they expand retention beyond the workstation.

Technical breakdown

Where agent telemetry lives in the harness

Agent harnesses can generate two broad telemetry streams: local session artifacts and exported OpenTelemetry records. Session files on disk are rich but operationally awkward, while OTLP export sends a slimmer security-oriented view to a collector. The key distinction is scope. Session files may contain more context, but OpenTelemetry is better suited to central ingestion, search, correlation, and retention in security tooling. For defenders, the architecture choice is not about which stream exists. It is about which stream can be governed, normalized, and retained long enough to support investigations and access review.

Practical implication: route agent telemetry into your security pipeline through OpenTelemetry export, not just local session storage.

What the export actually captures and omits

The export can include tool calls, approval decisions, model requests, command metadata, and in some cases command output or sandbox outcomes. But coverage is uneven by harness and configuration. Some fields are opt-in, some are always exported, and some never leave the machine. That means the collector may show who approved a call and what command ran, while prompt text or detailed arguments stay local unless explicitly enabled. For security operations, this creates a boundary between evidentiary telemetry and potentially sensitive content, which must be handled through redaction, hashing, or routing policy.

Practical implication: classify each exported field by sensitivity before forwarding it into SIEM or long-term storage.

Why local and external vantage points never tell the whole story

The article shows that model APIs and MCP servers see only the traffic they directly handle. That creates partial visibility by design. A model provider may know about model requests, and an MCP server may know about a tool call, but neither necessarily sees the local shell command, file edit, or approval state that gives the action security meaning. OpenTelemetry helps close that gap by providing a common event model that can be correlated with other telemetry sources. The remaining challenge is stitching identity, approval, and execution together in one operational timeline.

Practical implication: correlate harness telemetry with identity, endpoint, and cloud logs before you rely on it for incident analysis.

Threat narrative

Attacker objective: Exploit agent execution and missing telemetry boundaries to gain access to sensitive commands, data, or trusted tool paths without leaving a complete audit trail.

1. Entry occurs when an agent is allowed to run shell commands, read files, or call external services inside an interactive session.
2. Credential or sensitive data exposure can occur if prompts, command lines, or arguments contain secrets that are then exported or retained in the wrong place.
3. Impact emerges when security teams lack the approval trail and execution evidence needed to explain what the agent touched and who allowed it.

Breaches seen in the wild

• Sentry MCP Agentjacking 2026: Researchers showed a fake Sentry error, posted with a public DSN, could make AI coding agents run attacker code with developers' credentials.
• Anthropic GTG-1002 AI espionage campaign: A state-sponsored group ran Claude Code agents to attack about 30 organisations, harvesting and reusing credentials at machine speed.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Agent telemetry is becoming a governance control, not just an observability feature. When an AI agent can touch files, run commands, and call tools, the security value lies in the approval trail and execution context. That makes telemetry part of the control plane for agentic AI, especially where machine identity, delegated access, and auditability overlap. Practitioners should treat this as a policy and evidence design problem, not a logging exercise.

OpenTelemetry gives teams a practical way to unify fragmented agent evidence. The article shows that harness files, model APIs, and MCP servers each see only part of the session. A common export path creates a better basis for correlation across IAM, endpoint, and SOC workflows. For NHI governance, that is the difference between knowing an action happened and being able to explain who or what authorised it.

Telemetry gaps create a hidden trust gap in agentic systems. If the collector never receives the approval decision, command line, or sandbox outcome, then review processes are forced to infer intent from incomplete traces. That weakens incident reconstruction, access attestation, and delegated authority review. Practitioners should view missing telemetry as a governance defect, not a harmless configuration choice.

Decision evidence matters more than raw volume. The article’s most useful signals are not the largest payloads but the records that show who approved a tool call, by what source, and under what mode. That is the named concept here: agent decision provenance, the chain of evidence that makes agent actions attributable. Security teams should prioritise preserving provenance over retaining every possible transcript field.

Agent observability will increasingly sit alongside NHI and IAM controls. Once agents are operating as active runtime actors, their telemetry becomes the evidence layer for access governance, not a separate engineering concern. Teams that already manage service accounts, workload identities, and privileged access should extend those disciplines to agent sessions. The practitioner conclusion is clear: if the agent can act, the organisation must be able to prove how it was allowed to act.

From our research library:

• Claude Code-assisted commits leaked secrets at a rate of 3.2%, more than double the human-only baseline of 1.5%, with peaks reaching 31 secrets per 1,000 commits in August 2025, according to the State of Secrets Sprawl 2026.
• 92% of organisations expose NHIs to third parties, raising concerns about supply chain security, according to the Ultimate Guide to NHIs.
• Read next: AI Agent Observability, Audit and Incident Response Guide

What this signals

Agent decision provenance is the practical control gap here: if a session produces commands, approvals, and outcomes but the collector cannot join them, the organisation cannot confidently explain delegated agent action. That shifts agent governance from transcript storage to evidence preservation, which is where IAM and NHI teams should focus.

Security teams should expect agent telemetry to behave like other identity evidence streams, with collection, retention, and correlation mattering more than raw volume. The operational win comes from linking approvals and execution to a session identity, not from storing every possible prompt.

The scale problem is real, but the governance problem is bigger: Claude Code-assisted commits leaked secrets at a rate of 3.2%, more than double the human-only baseline of 1.5%, with peaks reaching 31 secrets per 1,000 commits in August 2025, according to the State of Secrets Sprawl 2026. That is a reminder that machine-assisted workflows need evidence controls before they need more trust.

For practitioners

• Enable OpenTelemetry export for all agent harnesses Turn on OTLP export in every environment where an agent can run commands, call tools, or request approvals, and make the collector the authoritative destination for security review.
• Classify and redact sensitive telemetry fields Treat prompt text, command lines, arguments, and output as potentially sensitive content, then hash, redact, or route them according to your logging policy before long-term retention.
• Correlate agent events with identity and endpoint logs Join approval events, tool calls, sandbox outcomes, and session identifiers with user, host, and endpoint telemetry so investigations can reconstruct who authorised what and when.
• Validate coverage across local, model, and MCP paths Test whether your pipeline captures local shell activity, model requests, and MCP interactions together, because each source sees only part of the session and partial logs create blind spots.

Key takeaways

• Agent harnesses already generate security-relevant evidence, but defenders only benefit when export, retention, and correlation are designed into the pipeline.
• The key issue is not lack of telemetry generation, but whether teams can preserve approval provenance and execution context across local, model, and tool layers.
• Security teams should treat agent logs as governance evidence and apply redaction, identity correlation, and central retention before relying on them for operations.

Key terms

• Agent telemetry: Operational data describing what an AI agent did, which tools it called, how much it consumed, and what resources it touched. Telemetry is essential for audit, incident response, and behavioural governance because agent decisions are otherwise difficult to reconstruct.
• Access Provenance: Access provenance is the record of how an identity was created, approved, used, and withdrawn. In NHI governance, it is the evidence trail that lets teams prove an account is legitimate, explainable, and still within its intended access boundary.
• OpenTelemetry: An open standard for collecting and moving traces, metrics, and logs in a consistent format. It helps teams avoid re-instrumenting every system when tools change, and it supports cross-platform analysis by keeping telemetry structured and portable.
• Session-Level Correlation: Session-level correlation links identity events across logs and tools into one continuous access story. This is critical when an attacker uses valid credentials, because isolated events can look harmless while the full sequence reveals compromise, privilege abuse, or lateral movement.

Deepen your knowledge

NHI Mgmt Group covers identity security, NHI governance, and agentic AI through independent research, practitioner guides, and the NHI Foundation Level course. It is suitable for security practitioners who need to connect access governance with machine and agent behaviour.