13 MILLION TOOL CALLS: AUDITING EVERY AI CODING AGENT ACTION WITH ELASTIC AGENT

Summary from the TLDR InfoSec newsletter

Elastic's Security Labs rolled out zero-dependency bash and PowerShell-based hooks for agentic IDEs like Cursor and Claude Code to monitor the commands run by AI agents in their environments. Elastic focused heavily on restricting who has access to agent logs and only collecting metadata to ensure user privacy. The article includes some sample ESQL queries for threat hunting and information extraction utilizing these logs.