Topical Takes

Short, opinionated posts on eBPF, Linux internals, and the tools we all run in production.

AlleBPF10linux9observability6yeet6networking3tcpdump3AI agents2HTTP2kubernetes2802.111ai-sre1audit1Cilium1claude-code1integration-testing1opentelemetry1packet-capture1Redis1RESP1rf1root-cause-analysis1security1slowlog1tunnels1uprobes1websocket1wifi1wireguard1wireless1wss1

How to Audit What an AI Coding Agent Actually Ran on Linux in 2026: The Log Stops Where the Shell Begins

Claude Code, Codex and Cursor all log their tool calls, and Anthropic documents the boundary in its own docs: OTEL_* is never passed to the subprocesses the Bash tool spawns. Compare what OpenTelemetry, an MCP gateway, auditd, strace and a kernel probe each record when an agent runs a shell one-liner, and see which one can name the commands underneath it.

claude-codeai-agentsauditopentelemetryeBPFobservabilitylinuxyeet
Read more →