Notifications
Clear all
Topic starter
18/08/2026 2:52 pm
TL;DR: Claude Code already emits per-session cost, token counts, tool calls, prompts, and session metrics through OpenTelemetry, but the Anthropic console only shows aggregates, according to Bindplane. That makes telemetry routing, redaction, and administrator-managed deployment the real governance questions for teams adopting AI coding tools.
NHIMG editorial — based on content published by Bindplane: Claude Code telemetry can now be routed through OpenTelemetry and Bindplane
By the numbers:
- AI-related credential leaks surged 81.5% year-over-year in 2025, with the surrounding AI infrastructure leaking 5x faster than core LLM providers.
- 28% of secrets incidents now originate outside code repositories, in Slack, Jira, and Confluence, and are 13% more likely to be categorised as critical than code-based leaks.
- 64% of valid secrets leaked in 2022 are still valid and exploitable today, proving that detection alone is not enough without automated revocation.
Questions worth separating out
Q: How should security teams govern AI coding assistants that can execute commands?
A: Treat them as delegated non-human identities with bounded execution authority.
Q: Why is tool-result telemetry riskier than token or cost metrics?
A: Tool-result telemetry can include commands, file paths, and other runtime parameters that expose repository context or secrets-adjacent detail.
Q: What breaks when AI developer telemetry is configured locally on each machine?
A: Local configuration breaks consistency.
Practitioner guidance
- Implement telemetry redaction before export Inspect AI tool telemetry for command strings, file paths, and other parameters that could expose secrets, then redact or suppress those fields in the local pipeline before they reach any backend.
- Centralise export settings for developer AI tools Use administrator-managed configuration to standardise telemetry endpoints, protocols, and logging choices across the team instead of relying on per-user shell profiles.
- Separate operational telemetry from sensitive content Allow session counts, cost, and token metrics to flow, but put explicit controls around tool_result data and any optional prompt-content logging so higher-risk fields are reviewed first.
What's in the full article
Bindplane's full how-to guide covers the operational detail this post intentionally leaves for the source:
- Kubernetes in-cluster DNS names and how to wire the collector for production use
- TLS, authentication headers, and troubleshooting steps for the OpenTelemetry pipeline
- Step-by-step configuration for the OTLP source and destination setup
- Live Preview validation steps for confirming telemetry is flowing end to end
👉 Read Bindplane's how-to guide for sending Claude Code telemetry to Bindplane →
Claude Code telemetry and session auditing: what should teams do now?
Explore further
18/08/2026 3:36 pm
Telemetry from AI coding tools is now a governance surface, not just an observability feed. Claude Code is emitting enough session and tool activity to create a second control plane for sensitive development data. That matters because telemetry can reveal code paths, command execution, and the shape of developer work even when the application itself is not exposed. Practitioners should manage AI tool telemetry with the same discipline they apply to access logs and secrets logs.
A question worth separating out:
Q: Should organisations enable full prompt logging for AI coding tools?
A: Usually not by default. Full prompt logging increases the chance that sensitive instructions, context, or code fragments will be copied into telemetry systems that were intended for operational observability. Organisations should start with minimal necessary data, assess the review value of prompts, and enable richer logging only with explicit controls and justification.
👉 Read our full editorial: Claude Code telemetry exposes per-session AI usage and tool activity
