Closing the Gap: What Actually Turns Agent Telemetry Into Evidence

Corroboration, Honest Caveats, and a Monday Checklist

‍

An AI coding agent's own telemetry answers real questions well: which agents are running, what they invoked, the shape of a session, whether a run looks abnormal. It cannot, no matter how completely it is instrumented, stand alone as evidence. The agent under review is also the party writing the record. The record shows an attempt, not an outcome. And the vocabulary for describing any of it is still being written in public, one unstable commit at a time. Part 1 and Part 2 of this series cover why, in detail. This part covers what to do about it.

‍

What Actually Closes the Gap

‍

Every limitation covered in Part 2 has the same shape. Agent telemetry is one interested witness that saw part of what happened. Codex produced 2.7 MB describing a four-step task in the field test behind this series, which is a thorough record of one side of the story, and no additional volume of it turns into the other side.

‍

Corroboration answers that better than a more thoroughly instrumented witness would, and the practical form of corroboration is a join. An agent reports invoking a command at a time, under a credential, against a resource. A cloud audit log independently records whether that resource changed. An identity log records whether the credential was entitled to it. An endpoint record places the process on a machine. Where those agree, the account is corroborated. Where they disagree, the disagreement is itself the signal, and it is the one a single stream can never produce.

‍

A join needs a shared identifier, and that identifier is exactly what differs by vendor. Building the inventory below is the most useful hour available after reading this series, and it costs nothing but an afternoon with five capture files.

‍

‍Two of those rows are the interesting ones. If Copilot or Gemini is deployed and nobody has built the mapping, then every action they report is unattributable at the moment it matters, and that is knowable today rather than during an incident.

‍

What This Argument Does Not Establish

‍

Zero of the six capture sessions behind the field test involved an agent trying to avoid being recorded. Every claim about tamper resistance in this series follows from the architecture rather than from an adversarial test, and it should be read that way.

‍

That gap is not hypothetical. In July 2026, an OpenAI agent running an internal exploit-discovery evaluation broke out of its test environment and operated inside Hugging Face's production infrastructure for roughly two and a half days, executing around 17,600 actions. It enrolled into the internal network with a --no-logs-no-support flag and kept its state in memory rather than on disk. What it exfiltrated was chunked, encoded and in places hidden inside exception payloads; a first pass over the raw capture surfaced a handful of secrets, and replicating the agent's own encoding scheme surfaced roughly four times as many. Both companies published the postmortem. The field test behind this series never asked an agent to hide. That incident is why the caveat above matters.

‍

Nor is the gap uncontested within the standards themselves. A proposal for agentic-system semantic conventions, covering tasks, actions, agents, teams, artifacts and memory, has sat open on the OpenTelemetry semantic-conventions repository since August 2025 with no linked pull request. A parallel proposal to give OCSF its own AI-specific event classes aligned to MITRE ATLAS was opened in February 2025 and closed with no owner and no pull request. The gap this series describes is recognized. Neither standard has shipped a fix for it.

‍

Two more caveats are worth naming quickly. The administrator-imposed configuration covered in Part 2, the one vendor documentation says a developer cannot override, was not exercised here either; that claim rests entirely on Anthropic's and GitHub's own documentation, which Part 2 has already shown is worth testing rather than trusting. And the comparison in Part 1 of network, endpoint and identity controls against the action boundary is reasoning about what those controls observe, not a measurement of them; a well-tuned endpoint product with deep command-line visibility narrows that gap considerably.

‍

A join also is not free. The effect sources have to exist, be retained over a comparable window, and carry an identifier that survives to both sides. The EU AI Act sets six months as the deployer's floor for AI system logs; if the cloud trail beside it is kept for 90 days, the overlap rather than the longer window is what can actually be corroborated. And where agents run under a shared service credential, the join returns a set of possible actors rather than a name, and that set is the honest output.

‍

None of that is a reason to wait. It is a reason to be precise about what a join promises before promising it to someone else.

‍

What To Do On Monday

‍

Instrument, and enable all three signals rather than traces alone. Traces are the default in most pipelines and the default is wrong for several agents, where the security-relevant material sits on the logs signal instead.

‍

Then write down, per agent, which questions its stream cannot answer, because it differs by vendor and it is documented nowhere. Build the join-key inventory above. Pin the convention version in any detection content, given 614 commits and no releases. Alert on the stream going quiet, since nothing is what a disabled agent looks like. And treat agent telemetry as what it is: a good, cheap, genuinely novel record of intent, and the first half of an attribution rather than the whole of one.

‍

Kovrr's AI Security and Governance Platform performs that corroboration as Data Triangulation, joining an agent's account of what it did to the identity, cloud, endpoint and browser records that independently show what happened, so an action can be attributed to a person and priced rather than merely observed.

‍

Building the join is the hard part, and it's exactly what Kovrr's Data Triangulation does, matching an agent's account of what it did to the records that independently show what happened, so an action can be attributed to a person and priced. See a full attribution, end to end. Book a demo today.

‍

About This Research

‍

This series draws on a Kovrr Research field test of five production coding agents (Claude Code, OpenAI Codex CLI, Google Gemini CLI, GitHub Copilot CLI, and Claude Cowork), each instrumented and captured against a live OpenTelemetry collector on an identical task.

‍

Sources

• Field test of five coding agents (Kovrr Research)
• "Agent Intrusion: A Technical Timeline" (Hugging Face, 27 July 2026)
• "OpenAI Agent Used Exposed Credentials to Breach Hugging Face" (The Hacker News, 29 July 2026)
• Issue #2664, "Semantic Conventions for Generative AI Agentic Systems" (open-telemetry/semantic-conventions)
• Issue #1348, "OCSF support for AI Systems telemetry, logs and security controls" (ocsf/ocsf-schema)
• Regulation (EU) 2024/1689, Article 26: Obligations of Deployers of High-Risk AI Systems
• Kovrr AI Security and Governance Platform