Our Review Finds AI Agent Logs Differ in What They Capture and Who Keeps Them

A log can show that an AI agent ran without preserving what an investigator needs to reconstruct its actions. Our review of public documentation for Claude Code, OpenAI’s Agents SDK and Grok Bot finds different boundaries around what gets captured, where records go and who controls the route. None of the reviewed documentation establishes a complete, agent-proof action trail across the three products.

The comparison covers documented record content, capture location, retention and export paths through September 27, 2026. We did not configure the products, attempt to alter records or verify that a customer collector received every exported event. That makes this a finding about the controls companies describe, not a security test of deployed systems. It also means the word “log” is too broad to answer the useful question: what evidence of a particular action would remain?

Claude Code: the machine and the provider hold different records

Claude Code writes plaintext conversation and tool transcripts under ~/.claude/projects on the user’s machine. Covered files are cleaned up after 30 days by default. Local persistence can be skipped, and retained project transcripts can be purged. The file can help explain a session, but it is not an independently preserved audit record. Whether an agent could delete it in a particular deployment depends on its permissions.

Eligible Claude Enterprise local sessions have another record. Anthropic captures exchanges server-side as requests reach its API, then makes the transcript available to compliance reviewers through read-only endpoints. Retention is six years by default, or a finite period set through the organization’s conversation-retention policy. Purging the machine’s transcript does not purge that separately captured record. But read-only retrieval does not establish that the underlying storage is immutable.

That provider-held transcript covers API-visible prompts, responses and tool activity, not everything that happened on the device. It excludes Claude Code sessions authenticated with a Console API key, run through third-party cloud platforms or run as Claude Code cloud sessions. The documented HIPAA-readiness and zero-data-retention exclusions also remove local sessions from coverage. An investigator must therefore establish that a session was eligible before relying on this record.

Anthropic’s Compliance Activity Feed serves a different purpose: it records administrative and resource activity from the point the Compliance API is enabled, without backfilling earlier events or replacing session content. Claude Code can also send OpenTelemetry data to a customer collector when configured. Prompt text, tool arguments and tool-result content need separate capture settings. An exported event stream may therefore contain less detail than a transcript, while giving the customer its own storage path.

OpenAI: default tracing still leaves choices with the application

OpenAI’s Agents SDK traces model generations, tool calls, handoffs and guardrails by default for eligible organizations. Its client-side processor batches those traces for export to OpenAI. Yet application code can disable tracing globally or for an individual run. Developers can add a processor for another destination or replace the default processors entirely; replacement stops export to OpenAI unless they include that exporter. SDK tracing is unavailable for organizations using zero data retention.

Developers can also omit potentially sensitive model and tool inputs and outputs from traces. The default background export may not make a finished run immediately visible; the SDK provides an explicit flush for workflows that need delivery at the end of a job. Those controls offer choices about sensitive content and timing, but they also mean “tracing enabled” does not specify exactly what a later reviewer will find.

Grok Bot: an audit log is not an action trace

Grok Bot’s Enterprise audit log covers administrative, security, authentication and Bot control-plane events, including Bot creation and member access changes. Action Recording uses a separate pipeline and is off by default. When enabled, it keeps sanitized Bot action events in an internal store for 90 days. Recorded actions do not appear on the Audit Log page. An administrative entry alone cannot show whether the Bot’s actions in an incident were recorded.

Action Recording covers connector calls, secret-scrubbed shell commands, browser navigations and computer-use sessions. Computer-use summaries omit screenshots, clicks and typed text. They can establish that a session occurred without preserving each interaction inside it. An Enterprise customer that wants the sanitized action events in its own collector must separately configure OpenTelemetry Export; enabling Action Recording alone does not create a customer-held copy.

The deletion study tested a narrower boundary

A paper submitted September 24 reports that agents in tested local coding harnesses, including Claude Code and Grok Build, deleted their traces when asked without triggering monitor guardrails. The authors also report inducing deletion through external attacks. Their result gives a concrete reason not to assume a local trace will survive an agent’s access to its environment. It does not establish that Grok Bot or OpenAI’s Agents SDK has the same weakness: neither was among the systems identified as tested.