"Can You See What Your AI Saw?": GenAI Endpoint Observability for Detection Engineers

No ratings

Presented at [un]prompted 2026 by

Mika Ayenson

As GenAI coding assistants become standard developer tools, detection engineers face a new challenge: understanding what happens when AI executes commands on behalf of users. This talk explores the current state of GenAI endpoint observability from a practitioner's perspective, what telemetry exists today, where the gaps are, and why the industry needs standardized schemas for AI activity. Through real queries and telemetry examples, we'll walk through techniques for correlating AI-spawned processes across multi-level ancestry chains, discuss blind spots that surprised us during testing, and make the case for extending and adopting OpenTelemetry semantic conventions to cover GenAI tool activity on endpoints.