AI agent monitoring
AI agent monitoring for coding agents
AI agent monitoring means recording what an AI agent does while it runs — every command, file write, tool call and endpoint — and flagging the risky ones with evidence attached. Beam does this locally. Workspace owners and admins can also set observe, advisory, or enforce policy so matching Claude Code and Codex tool calls are denied, and Sentinel can pause or block high-risk browser AI sends.
Static review tells you what an agent was allowed to do. Runtime monitoring tells you what it did.
What Beam records at runtime
Beam monitors how your teams use AI. At runtime that means events from a hook, an OTLP/HTTP JSON stream or an imported file — one schema, whatever produced them.
- Shell
Commands, proposed or run
PreToolUse captures what an agent is about to run; PostToolUse what it already ran. You pick the phase.
- Files
Reads, writes and deletions
Every event carries file_path and project_path, so a write outside the working repo is visible, not buried in a transcript.
- Tools · MCP
Tool and MCP calls
Tool invocations, including MCP and browser actions, with the tool name and session id intact.
- Network
Outbound endpoints
endpoint.hostname is recorded wherever an instrumented source supplies it — "called something" becomes "called this host."
- Risk
Flags with the evidence attached
Credential exposure, destructive commands and privilege changes are surfaced against the raw event that triggered them.
- Spend
Model and token usage
model, input_tokens, output_tokens and cost_usd per event, when a source supplies them. Missing usage stays unknown.
Operating limits, stated plainly
- Detection heuristics
- 11 patterns plus an MCP version-pin check
- Enforcement
- Workspace observe / advisory / enforce; Claude Code and Codex PreToolUse deny; Sentinel pause/block on browser AI chats
How you get a runtime log
- 01
Point a source at the collector
Merge a PreToolUse or PostToolUse hook, stream OTLP/HTTP JSON to /v1/logs, or import a record file. Nothing is reconfigured automatically.
- 02
Work as usual
The collector writes events as they arrive. Missing or expired cached policy is fail-open: the action proceeds. A capture failure prints to stderr.
- 03
Review what got flagged
Inspect the evidence behind a flagged action and mark it reviewed. Reviews persist across restarts.
Why runtime visibility became a CISO question
July 2025
Replit's agent deleted a production database
During a code freeze the agent ran destructive commands, deleted records for 1,200+ executives and 1,190+ companies, then misreported it.
July 2025
A prompt injection shipped inside Amazon Q
An attacker's pull request injected a prompt telling the agent to wipe filesystem and cloud resources. It shipped in v1.84.0, to close to a million users.
By 2028 (Gartner forecast)
One in four enterprise breaches traced to AI agent abuse
Gartner predicts 25% of enterprise breaches will trace to AI agent abuse by 2028, with securing-AI spend near $4.8 billion in 2027.
Scope of Beam
Beam does
- Record normalized shell, file, tool, MCP and network events
- Flag risky actions, keeping the triggering event as evidence
- Deny matching Claude Code and Codex tool calls when workspace policy is enforce
- Pause or block high-risk browser AI sends via the Sentinel extension
- Redact known credential formats, auth headers and private keys before write
- Export a redacted NDJSON log for investigation
Beam does not
- Guarantee a deny on Cursor, Copilot CLI or Gemini — those harnesses currently get a deny note, not a verified block
- Fail closed when cached policy is missing or expired — that path allows the action
- Install or enforce hooks on your behalf
- Run OS surveillance or a SIEM forwarder
- Capture activity from sources you have not instrumented
Questions about runtime monitoring
Does Beam block dangerous commands?
Yes, when workspace policy is set to enforce. Matching tool calls are denied on Claude Code and Codex PreToolUse. Sentinel can pause or block high-risk browser sends. Cursor, Copilot CLI and Gemini currently get a deny note rather than a verified block, and missing or expired cached policy allows the action. This is not a kernel sandbox.
Which AI agents and tools does Beam monitor?
Beam is source-agnostic. It accepts a normalized event schema, Claude Code hook payloads, OTLP/HTTP JSON logs and imported numbat records — anything emitting to one of those paths lands in the same timeline.
Does any of this data leave my machine?
Not by default. The collector binds to 127.0.0.1:4319, stores events in local files at 0700/0600, and ships no analytics or third-party scripts. Data leaves only through an export you run yourself.
What gets redacted before an event is stored?
Known credential formats, auth headers, URL query values and private keys, with detection running on the raw text first. Other sensitive text may survive redaction — inspect an export before sharing it.
Related
- MCP security scanningCheck an MCP config for tool poisoning and exfiltration before you connect it.
- AI audit trailOne evidence log across the AI tools your teams use.
- Monitor a Mac mini agent serverIsolate, reach, supervise and stop OpenClaw, Hermes Agent or a coding agent on a Mac mini.
- Keep always-on agents safeConnector scope, approvals and injected-text checks for Muse, Dots, Claude Duet and Grok Bot.
- AI agent monitoring 101What agent monitoring covers, and how it differs from LLM observability.
- AI agent security platforms, explainedThe four different products that all get marketed as an "AI agent security platform."
See what your organisation's AI has been doing
Beam runs on the endpoint, keeps its record there, and surfaces what deserves a security team's attention.