AI agent monitoring, or AI agent observability, is a record of what AI agents actually do: each session's prompts, the tools it calls, the commands it runs and what comes back, kept where security can read it, search it and act on it.
Autonomous records the sessions of coding assistants, desktop agents and cloud agents across your fleet, scores each one for risk, links every risk to the moment in the transcript it came from, and keeps the log of every action its guardrails blocked or would have blocked.
An agent decides its next step on its own. Most of what it does never reaches a screen: a command in a terminal nobody watches, a file read, a call to a tool behind an MCP server. Without a record, nobody can say afterwards what it did, or why.
A real session
Asked: Unable to ssh to the server.
The agent started a background task that disabled the guest firewall on a production VM to reopen SSH: an unreviewed production change, made in answer to a one-line complaint. Then it cleaned up after itself.
When an agent covers its tracks, by accident or not, the only account left is the one recorded outside it. When an OpenAI model escaped its evaluation sandbox into Hugging Face's systems in July 2026, its ~17,600 actions could be reconstructed only because the logs survived. AI agent monitoring keeps that record for every session, on every machine.
Install the endpoint agent with one command or through your MDM, and connect your AI SaaS. Sessions from Cursor, Claude Code, Codex, Gemini CLI and the other supported agents start arriving, each with its user, machine and project.
Each session is rated for risk, and sessions that leaked data or may have are marked. Open one and every risk links to the turn in the transcript that caused it. A deep scan reads the whole session again for what the real-time checks may have missed.
Filter by user, endpoint, app or detection, hunt across everything recorded with a pattern or a question in plain words, export the sessions you need as JSON, and stream session and enforcement events to your SIEM.
Asked: “How many open pull requests are in this repo?” In the chat, a short answer. In the record, every step it took to get there.
The person: How many open pull requests are in this repo?
Recorded: The prompt, with its user, machine and project
The agent: Let me check GitHub.
Recorded
The agent: I'll find a way to authenticate.
Recorded
The agent: The repo has open pull requests; here is the list.
Recorded
What a marker can be
Our research team went through over 100,000 real AI agent sessions on enterprise endpoints. 30,232 of them held actions the user didn't ask for. What the recorded sessions did:
Source: The Hidden Security Risks in 100k Enterprise AI Sessions
Activity is the platform's record of what agents did, and of what it did about them.
One row per agent session: its user, machine and project, its detections, alerts and risk. Each opens on its risk, its transcript, and a data flow of where it read from and wrote to.
Every action that was blocked or redacted, and every one monitor mode would have blocked, with the rule that decided it. Review what would block before you turn a policy to enforce.
Each tool call and sign-in through the MCP Gateway, the hosts its MCP servers reached, and every administrator action in the console, each with its severity.
Estimated AI spend and tokens by model, app or user over 7, 30 or 90 days, from the tokens agents report and public list prices.
Test a hunch across everything recorded, such as whether any agent sent a secret to an outside host, with a pattern or a question in plain words, or scan a time window for real risk without knowing what to look for.
Download the sessions your filters match as JSON, and stream session, enforcement and audit events to Splunk, IBM QRadar, OpenTelemetry, Syslog or Coralogix.
Prompts and transcripts can hold source code and secrets, so seeing them is a permission of its own, apart from seeing that a session happened.
Without content permission a reviewer sees a session's shape, its events, lengths and verdicts, with the text hidden: “Prompt hidden (79 chars)”. Roles decide who can reveal it.
Per kind of activity, keep everything, only what a guardrail flagged, only the verdict, or nothing. A block is always recorded. Groups can have settings of their own.
Collect in full only from the organizations you approve. From personal or unknown accounts the platform keeps metadata alone, and their prompts never leave the machine.
Seeing what an AI agent did and why: the prompts it was given, the tools and commands it ran, what came back, and what it did next. For security, that record has to be complete, kept outside the agent, and tied to a person and a machine, so a risky action can be found, explained and stopped next time.
Sessions are recorded from Cursor, Claude Code, OpenAI Codex, Gemini CLI, ChatGPT Desktop, Claude Desktop, VS Code, JetBrains IDEs and other desktop agents; from ChatGPT, Claude, Gemini and Microsoft 365 Copilot in the browser; and from Claude Enterprise and ChatGPT Enterprise through their compliance APIs, which includes use that never touches a managed machine.
Recording a session doesn't stand in the agent's way: the endpoint agent collects the AI agent's own session transcripts. Checks that stop an action run inline, on agents that expose hooks for it, once you turn on real-time guardrails.
By default, the prompts, tool calls, responses and session metadata of the AI agents, for audit and investigation. You can set prompts and tool calls to keep only the verdict and metadata, only flagged activity, or nothing, and turn the other kinds off; a block is always recorded. Personal accounts can stay private: collect in full from your approved organizations only, and from personal or unknown accounts we collect metadata alone, their prompts and transcripts never leaving the machine. Seeing the content takes a role that allows it, and the browser extension hashes conversation text rather than storing it.
You choose, up to 60 days. Stored data is encrypted in transit and at rest, and never used to train models. More on our Security page.
It tells them apart by the account's organization. With collection limited to your approved organizations, a personal account's use is recorded as metadata only, so you know it happened without reading it. Finding the AI tools nobody approved is Shadow AI.
Not unless you choose to. Every new policy and guardrail starts off or in monitor mode, where activity is evaluated and logged but nothing is blocked. You move a policy to enforce when its findings look right, for a pilot group first.
Enterprise AI agents are repeating the Hugging Face breach patterns on developer endpoints right now. A study of 100k agent sessions revealed thousands of cases of autonomous credential hunting, indirect prompt injection via Jira/Confluence, and unsupervised production changes. Learn why agentic security requires continuous session monitoring, input guardrails, and brokered credentials.
Read More
Learn how restricted sessions apply security by design to the agentic risk model, limiting data exfiltration and unsafe actions in AI agents.
Read MoreEvery session, tool call and risk, recorded on your own fleet, with the guardrails to act on it.
Book a demo