TL;DR: Agentic coding harnesses can report tool calls at the network, harness, and endpoint layers yet still miss what actually ran, according to Origin's analysis, because wrapper logic, environment expansion, and in-process telemetry can all diverge. Trace integrity now depends on correlating multiple layers, not trusting any single emitter.
At a glance
What this is: NHI Mgmt Group's analysis, drawing on Origin's blog post: Agentic coding harness telemetry can agree at several layers while still misreporting what the endpoint actually executed.
Why it matters: IAM and security teams need trustworthy execution evidence for AI-assisted operations because agent actions can be shaped, rewritten, or obscured between model output and endpoint reality.
Context
Agentic coding systems create a telemetry problem because the same action can be observed as a model output, a harness claim, and an operating-system event, yet none of those views is complete on its own. In security operations, that means the evidence chain for an AI-assisted command is only as strong as the least trustworthy layer, which is why agent observability and incident response matters here.
The core issue is not whether the agent can be logged, but whether the log captures the action as executed rather than as described. Where environment expansion, wrapper scaffolding, or local process handling changes the effective command, the trace can remain internally consistent and still be wrong. That is an emerging governance gap for teams that will rely on agent traces as operational evidence.
Key questions
Q: How do agent tool calls differ from endpoint execution?
A: Agent tool calls are the instructions the model issues through the harness, while endpoint execution is the action the machine actually performs after wrappers, shell expansion, and local runtime handling. Those can match, but they can also diverge. Teams need to compare the request, the wrapped command, and the resulting process or file event to know what really happened.
Q: Why can harness logs disagree with system telemetry?
A: Harness logs can disagree with system telemetry when the agent’s own execution record is incomplete, delayed, or written at a different layer than the operating system or cloud collector. Common causes include buffered writes, dropped events, clock skew, redacted tool calls, and wrapper code that records intent while system telemetry captures only actual process, network, and file activity.
Q: How should teams implement observability for AI agents that call tools and APIs?
A: Teams should instrument the agent path end to end, from user input through retrieval, tool execution, and final response. That gives visibility into orchestration, makes failures easier to localise, and supports repeatable debugging. In practice, capture traces for every invocation, preserve the conversation context, and ensure tool calls are recorded so teams can inspect why an agent chose a specific action.
Q: What signs show an agent trace has drifted?
A: An agent trace has drifted when the recorded steps no longer match the live execution path, such as missing tool calls, unexpected branches, changed prompt context, or wrapper processes that appear without a corresponding recorded action. Other signs include gaps in timestamps, inconsistent tool arguments, and a final outcome that cannot be reconstructed from the trace alone.
Technical breakdown
Why network telemetry and harness logs can both be incomplete
A coding agent usually produces several artefacts for one action: the model request, the tool call, the harness's own record of execution, and the operating-system event that actually reflects the process or file operation. These layers are not equivalent. Network telemetry sees the request before local interpretation. Harness logs see what the wrapper chose to report. Neither layer guarantees the final endpoint effect, especially when a shell, script runtime, or environment variable changes the command after logging. See the AI Coding Agents Security Guide.
Practical implication: Treat network and in-process logs as useful context, not definitive proof of execution.
How wrapper scaffolding changes what the endpoint really does
Many agent harnesses do not execute the requested command directly. They wrap it in local scaffolding such as shell startup flags, temp-file writes, output handling, and exit-code capture. That wrapper can alter the effective command, add side effects, or expand placeholders before the child process runs. The result is a trace gap: higher layers record the requested action, while the endpoint records the transformed action. This is especially important when commands include environment variables or late-bound file paths.
Practical implication: Inspect the fully expanded endpoint command path, not only the text shown in the agent interface.
Why in-process telemetry is still not a trust boundary
OpenTelemetry from inside the harness improves standardisation, but it is still emitted by the same process that is making the decision. That means the telemetry source can be influenced by the very workload it reports on, whether through process tampering, altered wrappers, or logic that never emits the full output. In trust terms, in-process observability is a claim from inside the blast radius, not an independent witness.
Practical implication: Anchor trust in endpoint-level evidence and validate harness telemetry against independent system telemetry.
Threat narrative
Attacker objective: The attacker wants to create a trustworthy-looking trace that conceals the true endpoint action, so defenders cannot reconstruct what the agent actually did.
- Entry begins when a user prompt reaches the coding agent and the model selects a tool call that will be executed locally on the endpoint.
- Credential access or manipulation occurs when the wrapper, environment expansion, or in-process logging path changes what is actually executed or reported.
- Impact follows when defenders rely on incomplete or rewritten telemetry and lose confidence in the trace of agent-driven actions.
Breaches seen in the wild
- PocketOS database deletion incident: An AI coding agent found an over-privileged Railway API token in the codebase and deleted PocketOS production data and backups in nine seconds.
- Sentry MCP Agentjacking 2026: Researchers showed a fake Sentry error, posted with a public DSN, could make AI coding agents run attacker code with developers' credentials.
Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.
NHI Mgmt Group analysis
Agent telemetry is not evidence until it is cross-layer verified: the article shows that network logs, harness logs, and endpoint telemetry can all describe the same turn yet still disagree on the real action. That is a governance problem, not a logging problem. Security teams that use agent traces for investigations or approvals need independent endpoint corroboration, because an in-process emitter is never a neutral witness.
Wrapper-induced trace drift is the new observability gap: the most useful named concept here is the gap between what the agent requested and what the endpoint actually executed. Wrapper scaffolding, shell expansion, and temp-file handling can create a record that is internally consistent but operationally false. That makes trace fidelity a control objective, not a monitoring nicety.
Agentic systems turn observability into an integrity control: in agent operations, the question is no longer only whether something was logged, but whether the logged event survives transformation between the model and the machine. That pushes observability into the same governance category as execution control and change assurance. Practitioners should treat trace verification as part of the security boundary, not an after-the-fact reporting layer.
Endpoint telemetry remains the closest thing to ground truth, but only partially: system telemetry can show the process, parentage, and command line, yet it still may not capture the original intent or the full side effects of wrapper logic. That means the operational answer is not a single source of truth. It is correlation, with the machine-level event as the anchor and the higher layers as supporting context.
This problem sits at the intersection of AI governance and identity governance: when an agent uses tool access on behalf of a user, the control question is who or what had authority to issue the action, and what evidence proves that authority was exercised as intended. That is why agent identity governance and execution evidence belong together. Auditability without trustworthy execution evidence is only a partial control.
From our research library:
- Claude Code-assisted commits leaked secrets at a rate of 3.2%, more than double the human-only baseline of 1.5%, with peaks reaching 31 secrets per 1,000 commits in August 2025, according to the State of Secrets Sprawl 2026.
- Read next: AI Agent Observability, Audit and Incident Response Guide
What this signals
Execution trace fidelity: the next control problem for agentic platforms is not simple logging coverage, but proving that the logged command survived wrapper expansion and runtime interpretation unchanged. That shifts observability from a monitoring practice to an integrity check, especially where agent output can influence file writes, shell execution, or downstream automation.
The practical programme implication is that teams will need separate evidence paths for request, wrapper, and endpoint. Once those paths exist, discrepancies become actionable signals rather than confusing noise, which is how agent oversight moves from visibility to verification.
For practitioners
- Define endpoint evidence as the authoritative record Require machine-level telemetry for agent actions that can change files, processes, or system state, and do not treat harness logs as sufficient proof on their own.
- Correlate tool calls to expanded execution Store the original tool request, the wrapped command, and the child process result together so investigators can compare intent, wrapper behaviour, and endpoint execution.
- Detect trace drift between layers Alert when the tool name, command text, or file effect differs between network records, in-process logs, and endpoint telemetry for the same session.
- Constrain shell and environment side effects Limit late-bound expansion, inherited environment variables, and wrapper-generated file writes in agent harnesses so the executed action stays close to the requested action.
Key takeaways
- Agentic coding traces can look complete while still missing the actual endpoint effect because wrappers and runtime expansion change what gets executed.
- The strongest evidence comes from correlating network, harness, and operating-system telemetry, not from trusting any single layer.
- For practitioners, trace integrity should be treated as a control objective, with endpoint verification and discrepancy detection built into agent governance.
Related NHI Mgmt Group resources: AI Coding Agents Security Guide · AI Agent Observability, Audit and Incident Response Guide · Zero Trust for AI Agents
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP Agentic AI Top 10 and MITRE ATT&CK address the attack and risk surface, while NIST CSF 2.0 and NIST AI RMF set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| OWASP Agentic AI Top 10 | ASI03 — Identity & Privilege Abuse | Agent tool execution hinges on delegated authority that can drift between request and endpoint action. |
| ASI05 — Unexpected Code Execution | Wrapper logic and shell expansion can turn a benign-looking tool call into different code on the endpoint. | |
| Recommendation — Correlate delegated tool actions to the identity and privilege context that actually executed them. Inspect and constrain wrapper paths so the executed command matches the requested action. | ||
| NIST CSF 2.0 | DE.CM-01 — Continuous Monitoring | The article is fundamentally about the limits of monitoring when evidence sources disagree. |
| DE.AE-02 — Detection of Anomalies and Events | Divergence between tool call logs and endpoint execution is an anomalous event that requires detection. | |
| Recommendation — Monitor agent activity with independent telemetry sources and flag cross-layer mismatches. Detect and investigate mismatches between declared tool actions and observed machine behaviour. | ||
| MITRE ATT&CK | TA0005;TA0006 — Defense Evasion; Credential Access | Tampered or misleading traces help attackers hide what the agent actually did and what access was used. |
| Recommendation — Map trace manipulation to ATT&CK and hunt for evidence tampering alongside credentialed agent activity. | ||
| NIST AI RMF | MEASURE — AI Risk Measurement and Evaluation | Trace fidelity is a measurable AI governance property, not just an operational convenience. |
| Recommendation — Measure whether agent logs reproduce the actual endpoint effect under wrapper and runtime variation. | ||
Key terms
- Agentic Harness: The orchestration layer that lets a model choose tools, execute actions, and repeat a task loop until a goal is met. In practice, it is what turns a model from a responder into an actor, so identity and privilege controls must govern the harness, not just the model.
- PowerShell Wrapper: PowerShell wrapper is a script or process that launches PowerShell and controls how commands are passed, logged, constrained, or obscured. It is often used to normalise execution, set parameters, or hide the underlying command line, which can affect monitoring, policy enforcement, and incident investigation.
- Tool Call ID: Tool Call ID is the identifier attached to a specific call from an AI agent to a tool or function. It lets the system correlate the request, the tool response, and the agent turn, which helps with tracing, debugging, and access audit of tool use.
- Endpoint Telemetry: Endpoint telemetry is the process and event data collected from managed devices to understand local activity. For shadow AI, it includes process spawns, file access, and direct outbound calls from the operating system, giving security teams visibility that network tools and SaaS logs often miss.
Deepen your knowledge
NHI Foundation Level course, the industry's only accredited NHI security programme, covers NHI governance, workload identity, and secrets management. It gives practitioners the grounding to apply identity controls to agentic systems and related access paths.
Published by the NHIMG editorial team on November 9, 2026.
NHI Mgmt Group, the independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org