Claude Code and Cowork monitoring exposes the agent logging gap

At a glance

What this is: This is an analysis of Claude Code and Cowork monitoring that finds agent telemetry is useful for detection only when it is enriched, correlated, and paired with host context.

Why it matters: SOC and IAM teams need this because AI agent logs without identity and endpoint context create blind spots in investigation, DLP, and suspicious execution detection.

Context

Claude Code and Cowork monitoring is a visibility problem before it is a detection problem. The core issue is that agent activity produces useful events, but those events are incomplete unless teams can correlate prompts, tool use, session boundaries, and host context into one investigation path.

For SOC teams, the governance gap is not simply whether the agent logs exist. It is whether those logs preserve enough identity, device, and execution detail to support alert triage, DLP checks, and post-incident reconstruction without forcing analysts to piece together fragmented telemetry by hand.

Key questions

Q: What breaks when agent logs do not include host context?

A: Investigation quality breaks because analysts can see what the agent did inside the application but cannot reliably tie that activity to an endpoint, a process tree, or another telemetry source. Without host context, session reconstruction stays partial and cross-source correlation becomes slow and uncertain.

Q: Why do AI agent logs need session and prompt correlation fields?

A: Those fields let analysts reconstruct the order of actions, link downstream tool use to the originating prompt, and distinguish one interaction from another. Without them, prompt, tool, and API events become a pile of records rather than an investigation timeline.

Q: How should security teams reduce the cost of agent telemetry without losing detection coverage?

A: Security teams should shift from sending all raw agent telemetry to the SIEM and instead run detections in the pipeline. Keep the full event stream in a data lake for investigation, but route only findings onward. That design preserves evidence, reduces ingest cost, and keeps heavy OpenTelemetry volumes from overwhelming downstream tooling.

Q: How can SOC teams detect malicious use of trusted agent execution paths?

A: Correlate agent-side events with endpoint activity on the same host and look for trust prompts, unexpected shell execution, or failed MCP startup patterns that align with secret access or file manipulation. The key is to join application telemetry with host telemetry before the session ends.

Technical breakdown

OpenTelemetry event flow for Claude Code and Cowork

Claude Code and Cowork generate structured OpenTelemetry events that can capture prompts, tool decisions, tool results, API activity, hooks, plugin installs, skill activation, and MCP server interaction. That matters because the telemetry model already separates user intent from execution outcomes, which makes downstream parsing and schema mapping feasible. The practical limit is not event volume alone, but whether the pipeline preserves the fields needed to reconstruct what happened. Without consistent enrichment, logs remain searchable but not investigative.

Practical implication: Normalize agent telemetry into a schema that keeps prompt, tool, session, and MCP fields usable for correlation.

Why host and session context matter for agent visibility

The article shows that Claude Code events are attributed to user.email and organization.id, while user.id is closer to an installation identifier than a true host name. That creates a correlation gap when investigators need to tie agent actions back to an endpoint, a process tree, or another security source. Session.id, prompt.id, and event_sequence help rebuild the interaction timeline, but they do not solve endpoint identity on their own. The mechanism works only when the agent stream is enriched with host context before storage.

Practical implication: Add host identity upstream so agent activity can be correlated with EDR, SIEM, and endpoint controls.

DLP and sensitive-data detection in agent prompts

The article’s pipeline approach shows how prompt and tool-input content can be inspected for secrets, credentials, and PII before storage or rule evaluation. Pattern matching flags likely secrets and can set a DLP marker, while redaction functions replace sensitive values such as SSNs. This is more than storage hygiene. It creates a control point where content can be detected, flagged, or removed before it becomes a durable investigative artifact. The limiting factor is false positives, so contextual matching matters.

Practical implication: Use pipeline-based pattern matching and redaction to stop secrets and PII from becoming persistent agent telemetry.

Threat narrative

Attacker objective: The attacker wants to turn trusted agent execution into a path for secret theft, persistence, and downstream data exfiltration.

1. Entry occurs when a user accepts a folder-trust prompt and a project-defined MCP server or script executes inside the agent workflow.
2. Credential access follows when malicious initialization code or shell execution reaches stored tokens, keychain material, or other sensitive secrets.
3. Escalation and impact occur when the attacker abuses that execution path to exfiltrate data, establish persistence, or trigger further tool-driven actions without meaningful analyst visibility.

Breaches seen in the wild

• reviewdog Action compromise 2025: A stolen maintainer token poisoned reviewdog/action-setup, leaking CI secrets including the tj-actions bot token used in the next attack.
• Nx s1ngularity attack 2025: Attackers stole Nx's npm token via a GitHub Actions flaw and shipped malware that stole 2,349 secrets and abused developers' AI CLIs.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Agent logging is only valuable when it is identity-aware: raw Claude Code and Cowork telemetry is not enough to govern agent activity at SOC scale. The events are useful because they expose prompts, tool calls, and MCP interactions, but the investigation value depends on stitching those records to user, session, and endpoint context. The practitioner conclusion is that agent observability is an identity problem before it is a logging problem.

Host context is the missing control plane for agent investigations: the article shows that user attribution and session reconstruction still leave a gap when endpoint correlation is absent. That gap weakens incident triage, makes suspicious execution harder to tie to a device, and limits confidence in detection tuning. The implication is that telemetry pipelines must carry endpoint identity forward, not just application events.

Prompt redaction and DLP need to live in the ingestion path: the article demonstrates that secrets and PII can be detected before they are stored, which turns the pipeline into a governance boundary rather than a passive archive. That matters because agent prompts often contain the sensitive material teams most want to inspect and least want to retain. The practitioner conclusion is to treat ingestion as a policy enforcement layer, not a storage convenience.

TrustFall shows a familiar abuse pattern in a new wrapper: an accepted project trust prompt can trigger code execution that reaches credentials, files, and later malicious actions. The security lesson is not that agent telemetry is novel, but that the execution chain is fast enough to outrun manual review if logs are not correlated in near real time. The practitioner conclusion is to detect at execution time, not after the session closes.

Telemetry reduction has governance value when it preserves detection fidelity: dropping low-value events can cut ingestion cost by 30% to 50%, but only if the retained signals still support investigation and correlation. The field should stop treating more data as inherently better. The practitioner conclusion is to reduce noise only after preserving the fields that prove what the agent actually did.

From our research library:

• Only 5.7% of organisations have full visibility into their service accounts, according to the Ultimate Guide to NHIs.
• Read next: AI Agent Identity Security Buyer's Guide

What this signals

Agent observability is becoming an identity and endpoint correlation problem: teams that treat Claude Code-style telemetry as a standalone log source will miss the investigative value that comes from binding application events to host identity and session state. That shift matters because the control point moves from after-the-fact search to pre-storage correlation and policy enforcement.

Visibility gaps now sit inside the pipeline, not just at the SIEM: prompt redaction, secret detection, and field reduction are only useful when they preserve the context analysts need later. The practical programme question is no longer whether to collect more data, but which fields must survive to make agent behaviour explainable in an incident.

Specialised guidance for AI agent identity and telemetry correlation is still immature, which is why practitioners should anchor their programme to agent identity controls rather than log volume alone. The agent logging gap is a governance gap first, and a detection gap second.

For practitioners

• Instrument agent telemetry with host identity Propagate host.name or an equivalent endpoint identifier into agent logs before they reach the SIEM so session and process correlation can survive storage and normalization.
• Preserve session reconstruction fields Keep session.id, prompt.id, and event_sequence available through parsing and enrichment so analysts can rebuild the interaction timeline without stitching by hand.
• Enable detailed tool logging Turn on tool-level detail collection so file paths, shell commands, and MCP server interactions remain visible for detection and incident review.
• Apply pipeline redaction before storage Use pattern-based redaction for secrets and PII in prompts and tool inputs so sensitive values are removed or flagged before they become durable records.
• Correlate agent alerts with endpoint detections Join failed MCP startup events, suspicious shell activity, and agent telemetry on the same host to reduce false positives and surface executable trust-prompt abuse.

Key takeaways

• Claude Code and Cowork create useful telemetry, but the logs only support defence when they are enriched with endpoint context and session identifiers.
• Agent observability is not solved by volume. The decisive issue is whether the pipeline preserves the fields needed for correlation, redaction, and reconstruction.
• Security teams should move visibility controls upstream, because prompts, tool calls, and MCP actions are most valuable before they become incomplete records.

Key terms

• Agent telemetry: Operational data describing what an AI agent did, which tools it called, how much it consumed, and what resources it touched. Telemetry is essential for audit, incident response, and behavioural governance because agent decisions are otherwise difficult to reconstruct.
• Session Reconstruction: Session reconstruction is the ability to replay what an agent saw, reasoned about, and executed during a workflow. In agent governance, it is essential for incident response because alert counts alone cannot explain whether a sequence was legitimate, manipulated, or partially compromised.
• Pipeline Redaction: Pipeline redaction is the removal or masking of sensitive content before telemetry is stored or widely exposed. In agent monitoring, it is used to prevent secrets and PII from becoming durable investigative artifacts while still preserving enough structure for detection and triage.
• Host Correlation: Host correlation is the practice of binding application events to an endpoint identity so separate log sources can be joined reliably. For AI agent monitoring, it closes the gap between agent actions and EDR or SIEM records when native logs do not expose a real host name.

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity security are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are responsible for identity security strategy or NHI governance in your organisation, it is worth exploring.