An AI agent reads a credential file, makes an outbound HTTP call, and writes to a database. Each action is individually permitted. None of them appear in a correlated sequence in any log. The attacker is gone before anyone asks what happened.
Production agent frameworks treat observability as an optional add-on. The result is a forensic blind spot. When an agent acts from prompt injection, memory poisoning, or cross-agent manipulation, the logs contain no evidence. Three attack classes exploit this gap by design, not by coincidence.
Traditional Logging Was Built for Deterministic Systems
The logging model that works for web apps assumes a deterministic function: input in, output out, query logged. That assumption breaks when the unit of execution is a reasoning loop with dynamic tool selection and stateful memory.
Standard SIEM and SOC tooling captures infrastructure events: HTTP requests, database queries, file access. It does not capture the reasoning that decided to make those requests. In a multi-agent pipeline, correlated actions span multiple processes with no shared session context in the infrastructure layer.
The NIST AI RMF Agentic Profile (AG-MS.1, CSA Lab, 2025) identifies required behavioral telemetry: action velocity baselines, permission escalation frequency, cross-boundary invocations, and delegation depth. None of these fit in standard structured logging schemas. The fundamental accountability question for an agent is not "what system call was made?" but "what reasoning produced that tool selection?" That reasoning happens inside the model, not in any loggable layer by default.
LangChain, AutoGen, and CrewAI Log Operations, Not Decisions
Every major agent framework provides some event logging. What they log by default is operational metadata: latency, tokens, errors. Not the decision-making sequence that produced those operations.
LangGraph requires explicit LangSmith integration to get trace-level visibility. State-diff tracing and node-level inspection are not on by default. CrewAI before v0.105 had no agent-to-agent handoff tracing: a task assigned by the orchestrator to a sub-agent appears as a single log entry on the orchestrator side. The sub-agent's reasoning is invisible.
AutoGen logs conversation message history but does not store intermediate reasoning steps. It cannot tell you which tool was selected next or what parameters were passed. The OpenAI Agents SDK captures call history but requires external instrumentation, Langfuse or Maxim AI, for security-relevant metadata like tool call inputs and outputs. The pattern across all frameworks: output only, no context. Teams that skip external integration get nothing forensically useful.
OpenTelemetry GenAI semantic conventions (opentelemetry.io, 2025) define the right attributes: gen_ai.input.messages, tool call spans with inputs and outputs. Content capture is opt-in. The standards exist; the deployment does not.
Three Attack Vectors That Exploit the Gap
Prompt injection via indirect content, memory poisoning, and cross-agent state manipulation are not just harder to detect without proper agent observability. They produce effects that, by design of current logging defaults, leave no trace correlating cause to consequence.
Indirect prompt injection: an adversary injects instructions into a webpage or document that the agent reads. The injection appears nowhere in user input, only in the retrieved content. The resulting tool call appears authorized. Without logging the retrieved content alongside the tool call, the injection is forensically invisible. Palo Alto Unit 42 (2025) observed this in the wild across multiple production agent deployments.
Memory poisoning across sessions: a malicious write to an agent's memory store is logged as a write event. The downstream influence across subsequent agent sessions, every future agent that reads that memory, is never correlated back to the original write. OWASP ASI06 (December 2025) identifies no out-of-the-box detection mechanism in any major framework.
Cross-agent state manipulation exploits the window between one agent's write and another's read. Without a semantic diff baseline, what the memory contained before versus after, there is no detection path. arXiv:2606.09692 demonstrates that audit logs can be identical under multiple incompatible delegation assignments. The log does not distinguish authorized delegation from spoofed delegation.
What Agent-Native Audit Logging Requires
Securing an agentic system requires a logging model designed around reasoning traces, delegation chains, and semantic state diffs. Not infrastructure events.
5 attributes that standard logging omits:
Full context window at the decision point. What did the agent see when it decided to call that tool. HTTP logs do not capture this. Application logs do not either.
Delegation chain with attribution. A sub-agent calling an API needs a logged delegation path back to the original user intent. arXiv:2606.04990 defines "evidence tracing" as a distinct requirement from execution logging.
Memory read provenance. Which memory entries influenced this decision, and when were they written. Without this, memory poisoning cannot be detected post-hoc.
Tool call I/O at content level. The tool name is insufficient. The full input and output, including any credentials, PII, or injected instructions, must be captured.
Action velocity baselines. NIST AI RMF Agentic Profile requires tracking when an agent's action rate deviates from baseline. This is the signal for runaway loops or compromised orchestrators.
TraceAegis (arXiv:2510.11203) proposes hierarchical and behavioral anomaly detection for LLM agents. The behavioral baseline cannot be computed without content-level logs.
Standards Define the Vocabulary — Adoption Is the Gap
OTel GenAI semantic conventions define the right vocabulary. Content capture remains opt-in, and most production deployments are not instrumented to the required level.
OWASP Top 10 for Agentic Applications (December 2025) covers ASI06 Memory Poisoning and ASI07 Insecure Inter-Agent Communication. Both require observability to detect. The list has no standalone "insufficient logging" item, unlike OWASP API Top 10 item 9 (Security Logging and Monitoring Failures).
The NIST AI RMF Agentic Profile (CSA Lab, v1) is the most specific framework for agentic security. AG-MS.1 mandates the 5 telemetry requirements listed above. Binding in US government contexts; voluntary elsewhere.
Andrea Fortuna (2026) documents a subtler problem: the agent's own logging mechanism is inside the agent's context. A sufficiently privileged injection can manipulate what gets recorded. Content-level capture must happen at the collection layer, not inside the framework.
Five Controls That Close Critical Forensic Gaps Today
Practitioners who cannot wait for framework defaults to improve have 5 actionable controls that address the audit trail problem.
1. Enable OTel GenAI content capture. Set OTEL_INSTRUMENTATION_GENAI_CAPTURE_MESSAGE_CONTENT=true. This single environment variable changes the forensic posture of LangChain, LlamaIndex, and OpenAI SDK deployments.
2. Log memory reads with write timestamps. Every memory read event should include when the item was last written, not just what it contained. This enables post-hoc correlation for memory poisoning.
3. Capture delegation chain at task creation. The original user intent, the delegation path, and each sub-agent's authorization must be in the same trace. OpenTelemetry context propagation handles this when configured.
4. Set action velocity alerts. If an agent calls a tool more than N times in M minutes, page. Runaway loops and injected loops have distinct velocity signatures.
5. Collect retrieved content alongside tool calls. The document or webpage the agent read must be logged in the same span as the tool call it influenced. Without this, indirect injection is forensically undetectable.
The MAGO Intel tool (intel.mago.team) scans agent execution traces for the forensic gaps described above. It identifies deployments where content capture is disabled, memory reads are unprovenanced, or delegation chains are incomplete before an incident makes them relevant.
Observability in traditional software exists because developers who debugged enough production failures made it a habit and then a standard. Agent frameworks are at the equivalent stage of early web development: logging is a developer convenience, not a security requirement. Every team shipping AI agents into production without a designed audit trail operates on the assumption that nothing will go wrong. That assumption has a well-documented failure rate.
Top comments (0)