Claude Code telemetry and session auditing: what should teams do now?

TL;DR: Claude Code already emits per-session cost, token counts, tool calls, prompts, and session metrics through OpenTelemetry, but the Anthropic console only shows aggregates, according to Bindplane. That makes telemetry routing, redaction, and administrator-managed deployment the real governance questions for teams adopting AI coding tools.

NHIMG editorial — based on content published by Bindplane: Claude Code telemetry can now be routed through OpenTelemetry and Bindplane

By the numbers:

• AI-related credential leaks surged 81.5% year-over-year in 2025, with the surrounding AI infrastructure leaking 5x faster than core LLM providers.
• 28% of secrets incidents now originate outside code repositories, in Slack, Jira, and Confluence, and are 13% more likely to be categorised as critical than code-based leaks.
• 64% of valid secrets leaked in 2022 are still valid and exploitable today, proving that detection alone is not enough without automated revocation.

Questions worth separating out

Q: How should security teams govern AI coding assistants that can execute commands?

A: Treat them as delegated non-human identities with bounded execution authority.

Q: Why is tool-result telemetry riskier than token or cost metrics?

A: Tool-result telemetry can include commands, file paths, and other runtime parameters that expose repository context or secrets-adjacent detail.

Q: What breaks when AI developer telemetry is configured locally on each machine?

A: Local configuration breaks consistency.

Practitioner guidance

• Implement telemetry redaction before export Inspect AI tool telemetry for command strings, file paths, and other parameters that could expose secrets, then redact or suppress those fields in the local pipeline before they reach any backend.
• Centralise export settings for developer AI tools Use administrator-managed configuration to standardise telemetry endpoints, protocols, and logging choices across the team instead of relying on per-user shell profiles.
• Separate operational telemetry from sensitive content Allow session counts, cost, and token metrics to flow, but put explicit controls around tool_result data and any optional prompt-content logging so higher-risk fields are reviewed first.

What's in the full article

Bindplane's full how-to guide covers the operational detail this post intentionally leaves for the source:

• Kubernetes in-cluster DNS names and how to wire the collector for production use
• TLS, authentication headers, and troubleshooting steps for the OpenTelemetry pipeline
• Step-by-step configuration for the OTLP source and destination setup
• Live Preview validation steps for confirming telemetry is flowing end to end

👉 Read Bindplane's how-to guide for sending Claude Code telemetry to Bindplane →

Claude Code telemetry and session auditing: what should teams do now?

Explore further

View Full Forum →  |  NHI Foundation Course →