Does AgentSight upload recorded sessions?

Recorded sessions are local unless the operator explicitly serves, exports, copies, uploads, or forwards their contents.

Can an AgentSight session contain sensitive data?

Yes. Depending on capture mode, sessions can include prompts, responses, commands, paths, headers, model or provider data, process activity, and network targets.

Does an empty AgentSight result prove that an action did not happen?

No. A result describes activity observed inside the selected recording and supported capture boundary; missing activity can also reflect scope, privilege, runtime, or probe limitations.

Does exporting AgentSight data change the security boundary?

Yes. Exporting a report, database, screenshot, or OpenTelemetry data moves selected information into another storage and access boundary that should have its own redaction, retention, and access controls.

Security

Keep recorded sessions local and under your control.

AgentSight can capture sensitive execution context from a privileged system boundary. The operator remains responsible for recording scope, storage, redaction, retention, export, and the conclusions drawn from observed activity.

Data and capture boundaries

Local-first is a storage default, not a sensitivity claim.

Decide what to record before capture, inspect the resulting session before sharing it, and treat every export destination as a separate security boundary.

Local-first storage

Recorded sessions stay on the machine unless you explicitly serve, export, copy, upload, or forward their contents. Local-first changes the default data path; it does not make the captured data non-sensitive.

Sensitive session contents

Depending on capture mode, sessions can include prompts, responses, commands, paths, headers, model/provider data, process activity, and network targets. Treat raw databases and exports like other sensitive development telemetry.

Privileged observation

Linux eBPF and user-space probe attachment can require elevated privileges. That privilege lets the operator observe supported system activity; it is not an authorization model for the agent and does not grant permission to share captured content.

Targeted recording

Prefer one selected agent command, process family, or bounded experiment over broad workstation capture. Narrow scope improves attribution and reduces unrelated data collected from the host.

Exports are a new data boundary

A local session can remain local while an exported report, OTLP stream, screenshot, or copied database leaves the machine. Apply redaction, retention, and access controls at each export destination separately.

Observed activity needs context

A file access, process spawn, or network connection is not automatically malicious. Compare the activity with the authorized task and runtime, and reproduce surprising behavior before drawing a security conclusion.

Before sharing a run

Reduce the artifact to the question another engineer needs to answer.

A useful review artifact can keep process relationships, event types, timings, path or destination classes, and exit status while removing raw content that is unnecessary for the decision.

Review boundary

What can enter a run?

The exact fields depend on the enabled capture paths. Model/TLS capture can expose request or response content and headers; process and file monitoring can expose commands and paths; network analysis can expose destinations. Inspect the recorded artifact before sharing it.

Review boundary

What should be redacted?

Remove or replace secrets, authorization values, private prompt/response content, proprietary source snippets, personal identifiers, and path details that are unnecessary for the review question. Preserve enough timestamps, event types, process relationships, and summarized scope for another engineer to verify the conclusion.

Review boundary

What does absence mean?

No observed event is not proof that an event never happened. Capture depends on the selected process family, privileges, runtime packaging, probe support, and recording interval. Re-run with a narrower experiment or a second data source when a conclusion depends on absence.

Review boundary

When is remote telemetry appropriate?

AgentSight can export supported model calls through OpenTelemetry, and reports can be copied to other systems. Send only the fields needed by the remote workflow. Content-rich local sessions do not need to become content-rich centralized traces by default.

Operational rule

Record narrowly, preserve provenance, and reproduce surprises.

Keep the AgentSight version, task boundary, repository or workload version, relevant recording options, and known capture limits with any security finding. A reproducible, scoped observation is more useful than a broad alert with no causal context.

01
Bound the task
Record one selected command or representative capability.
02
Inspect before export
Identify sensitive content and keep only what the review needs.
03
State capture limits
Separate observed absence from proof that an action never happened.
04
Reproduce the finding
Repeat surprising behavior before escalating a security conclusion.

Security reports

Share only what can be safely public.

AgentSight does not currently publish a private vulnerability-reporting channel. Do not place traces, credentials, tokens, sensitive path contents, or an unpatched vulnerability in a public issue. Use the public tracker only for a fully redacted, non-sensitive issue that is safe to disclose.

Report a non-sensitive issue Review the source repository