Claude Code and Cowork monitoring exposes the agent logging gap

At a glance

What this is: This is an analyst guide to monitoring Claude Code and Cowork event streams for SOC detection, with a focus on parsing, reduction, redaction, and correlation.

Why it matters: It matters because teams adopting AI coding agents need usable visibility into tool use, prompt content, and runtime behaviour without drowning in logs or missing abuse signals.

By the numbers:

• 17 minutes

👉 Read Abstract Security's analysis of Claude Code and Cowork threat detection and monitoring

Context

Claude Code and Cowork are AI coding agents that generate detailed OpenTelemetry events across prompts, tool use, file access, MCP server interaction, and plugin or skill activity. For security teams, the core problem is not whether telemetry exists, but whether it is structured well enough to support AI agent identity governance, SOC correlation, and abuse detection.

The visibility challenge is familiar from NHI programmes, but the actor has shifted toward agentic behaviour. When an AI system can request tools, touch files, and trigger downstream actions, teams need host, session, and prompt context to interpret what happened and whether the behaviour stayed inside policy boundaries.

That is why agent logging should be treated as an identity control problem as much as a detection problem. The article shows how collection choices, field enrichment, and selective reduction shape whether SOC analysts can actually investigate suspicious agent activity or only store an expensive stream of low-value events.

Key questions

Q: How should security teams monitor AI coding agents without overwhelming the SOC?

A: Focus on session-level correlation, not raw event volume. Keep prompts, tool execution, host context, and MCP activity tied together so analysts can reconstruct behaviour and spot abuse patterns. Then drop low-value noise only after confirming that the remaining fields still support investigations and alert triage.

Q: Why do AI agents create a visibility problem for IAM teams?

A: AI agents often appear outside formal onboarding through shadow AI, scripts, or workflow tools, so they never enter the normal identity inventory. Without discovery across browsers, endpoints, and automation layers, IAM teams cannot enforce policy, certify access, or prove accountability.

Q: What breaks when prompt logs are stored without redaction?

A: You create a privacy and secrets exposure problem inside your security telemetry. Prompts can contain credentials, personal data, or business-sensitive material, so unfiltered retention can expand risk instead of reducing it. Redaction lets teams keep useful evidence without preserving every sensitive string forever.

Q: Who is accountable when an AI agent takes action through an MCP server?

A: The accountable party is the human or team that authorised the agent's access, but only if the organisation can prove that chain. Without immutable logs that connect the initiating identity to the tool call and final action, accountability becomes weak, and legal or compliance teams lose the evidence they need.

Technical breakdown

OpenTelemetry event structure for AI coding agents

Claude Code and Cowork produce telemetry that looks like a sessioned identity trail rather than a simple application log. The key objects are prompts, tool decisions, tool results, API requests, hook execution, plugin installation, and MCP server connections. Correlation depends on session.id, prompt.id, and event_sequence, which let analysts reconstruct the order of actions and tie a prompt to downstream tool use. For identity teams, that matters because the logging model determines whether agent behaviour is auditable at all, not just whether logs exist.

Practical implication: define a minimum event schema that preserves session and tool lineage before turning on broad AI agent adoption.

DLP and PII redaction in AI agent pipelines

The article shows a pipeline pattern where sensitive content is detected in prompts or tool input using regex and context matching, then flagged or redacted before storage. That is especially relevant for secrets, PII, and regulated data because prompt logs can contain credentials or personal data even when the model itself is not the breach point. Redaction is not just a privacy feature. It is a governance boundary that determines what investigators can retain, what compliance teams can expose, and what attack evidence survives.

Practical implication: apply content-aware redaction to prompts and tool inputs before retention policies are finalized.

Correlation between agent telemetry and host activity

Abstract Security describes a higher-fidelity detection pattern that combines Claude Code log events with endpoint process telemetry on the same host. The logic is straightforward: a failed or suspicious agent event becomes much more meaningful when it coincides with shell execution, keychain access, or other high-risk host behaviour in a short time window. This is a detection engineering pattern, not a policy rule. The point is to move from isolated agent events to contextualised identity and process correlation that can surface trust-prompt abuse or tool-based execution abuse.

Practical implication: correlate agent logs with endpoint signals on the same host before deciding which events are worth alerting on.

Threat narrative

Attacker objective: The attacker wants to turn a trusted AI coding agent into a high-privilege execution and exfiltration path that leaks credentials or sensitive data.

1. Entry occurs when a malicious project or prompt causes Claude Code or Cowork to trust a repository and execute a project-defined MCP server or tool path.
2. Escalation occurs when the agent accepts tool access, reveals sensitive prompts, or runs commands that expose credentials, file contents, or local secrets.
3. Impact occurs when the attacker uses the resulting agent session and host access to steal credentials, move data out, or establish persistence through trusted automation paths.

Breaches seen in the wild

• Replit AI Tool Database Deletion — Replit vibe coding AI assistant deletes live production database and creates 4,000 fake user records.
• Meta AI Instagram Account Takeover — 20,225 Instagram accounts hijacked via compromised Meta AI support chatbot with overprivileged access.

Read our 52 NHI Breaches Analysis report for a comprehensive view of breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Claude Code and Cowork monitoring is an identity governance problem before it is a logging problem. The article makes clear that useful detection depends on preserving session lineage, prompt context, and tool execution detail. Without those identity links, the SOC is left with telemetry fragments that cannot support investigation or policy enforcement, which means the logging design itself becomes part of the control plane.

Agent telemetry creates a new class of identity visibility debt. Security teams are used to compensating for NHI sprawl with lifecycle, rotation, and review controls. AI coding agents add runtime behaviour to that problem, because the same session can contain prompts, tool calls, file access, and command execution. The practitioner takeaway is that the log source is only as valuable as the governance model around it.

Prompt redaction and DLP must be treated as retention controls, not only privacy controls. The article shows that sensitive input can be detected and masked before storage, which changes the evidentiary quality of the data as well as its compliance posture. That matters because the boundary between acceptable observability and over-collection is now part of NHI and agentic AI governance.

Runtime correlation is where agent monitoring becomes operationally credible. A single agent event rarely proves abuse, but a failed MCP startup plus suspicious shell execution on the same host can move a signal into actionable territory. That pattern is a named concept worth retaining: agent session correlation debt: the gap created when agent logs are not tied to endpoint telemetry, leaving SOC teams unable to distinguish normal tool use from hostile execution.

Claude Code and Cowork show that AI agent governance cannot stop at tool approval. The deeper issue is whether the organisation can reconstruct what the agent did, on which host, with which privileges, and in what sequence. That shifts the discipline from static authorisation to runtime accountability, which is now a core requirement for both NHI and autonomous-adjacent controls.

From our research:

• Only 1.5 out of 10 organisations are highly confident in their ability to secure NHIs, compared to nearly 1 in 4 for securing human identities, according to The State of Non-Human Identity Security.
• Lack of credential rotation is cited as the top cause of NHI-related attacks by 45% of organisations, followed by inadequate monitoring and logging at 37% and over-privileged accounts at 37%.
• For a broader lifecycle lens, see NHI Lifecycle Management Guide for how provisioning, rotation, and offboarding shape operational visibility.

What this signals

Agent session correlation debt: security teams will need to treat AI coding agent telemetry as an identity dataset, not just an observability feed. If the SOC cannot join agent events to host process activity and session lineage, the organisation will only know that something happened, not who or what actually executed it.

With 85% of organisations lacking full visibility into third-party vendors connected via OAuth apps, the underlying pattern is already familiar: identity blind spots grow fastest where access is delegated and difficult to inventory. AI coding agents amplify that problem because tool use can be legitimate while the execution path is still unsafe.

Teams that already struggle with NHI confidence will find agent visibility harder, not easier. The immediate programme response is to extend identity governance into runtime telemetry, then anchor that work in The 52 NHI breaches Report and NIST Cybersecurity Framework 2.0 so detection, review, and accountability move together.

For practitioners

• Preserve session lineage in the log schema Retain session.id, prompt.id, and event_sequence in the ingestion pipeline so analysts can reconstruct a complete agent interaction rather than isolated events.
• Enable detailed tool logging by default Keep tool-level fields such as file paths, shell commands, MCP server details, and hook metadata available for security review instead of relying on minimal event summaries.
• Apply prompt redaction before storage Mask secrets, SSNs, and other sensitive strings in prompt and tool input events before they reach long-term retention, especially where shared analytics access exists.
• Correlate agent events with endpoint telemetry Join Claude Code or Cowork events with host process data on the same machine so failed tool startup, shell execution, and keychain access can be evaluated together.
• Drop low-value events selectively Reduce volume by removing events such as tool_decision, at_mention, and internal_error where they do not materially support detection or investigation.

Key takeaways

• AI coding agents create an identity visibility problem because their behaviour spans prompts, tools, files, and host processes in one session.
• The article’s detection value comes from reconstruction and correlation, not from storing every event indiscriminately.
• Runtime governance for agent activity now depends on redaction, lineage, and host-level context, not just tool approval.

Key terms

• Agent session correlation: The practice of tying an AI agent’s prompts, tool calls, and host activity into one investigable sequence. For AI coding agents, this is the difference between seeing isolated log lines and proving what the agent actually did during a single runtime interaction.
• Name redaction: Name redaction is the practice of limiting exposed identity details in certificate records so public logs do not reveal more organisational or personal information than necessary. In certificate governance, it is a disclosure control that must be balanced against transparency requirements.
• Mcp Server Identity: The identity assigned to the gateway that mediates agent requests to tools and data sources. It matters because the gateway can become a privilege concentration point if it shares credentials with the agent or inherits broader permissions than the task requires.
• Trust-prompt abuse: A technique where a user or attacker leverages a repository trust prompt or similar approval step to trigger unsafe execution inside a development agent. It matters because the approval is treated as a trust signal, but the runtime effect can still be arbitrary code execution.

What's in the full article

Abstract Security's full post covers the operational detail this post intentionally leaves for the source:

• Step-by-step Claude Code and Cowork ingestion configuration for the Abstract Forwarder and OTLP receiver
• Pipeline examples for event dropping, aggregation, and deduplication to reduce log volume by 30% to 50%
• Detection logic for secret leakage, PII redaction, and trust-prompt abuse patterns
• Correlation setup that ties agent events to endpoint process activity on the same host

👉 The full Abstract Security post covers pipeline setup, detection examples, and host correlation details.

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an IAM or identity security programme, it is worth exploring.