AI Audit Trails and Gatsby fits: Monad at BSides NYC 2026

At BSides NYC 2026, Monad shared research on AI audit logs, including how Claude Code records tool calls, permission decisions, and blocked attempts. We also handed out copies of our refreshed book (going live next week!) and brought the NYC security community together for a Gatsby-themed night at Bar Bas.

We had some of our leadership team in NYC for the weekend. Between events, we caught up with friends in the community and finally met people we’d only ever spoke with online. Successful weekend on all fronts!

Friday night at Bar Bas

Before the conference, we got everyone together at Bar Bas for a Roaring Twenties pre-game. The room was swanky, people had fun with the theme, and there was plenty of catching up and dancing.

Putting on a night for the NYC security community was a highlight of the trip. Thank you to everyone who came through and made it such a good time.

And a huge thank-you to Runlayer, C1, Scanner, TachTech, and Surf AI for helping make it happen, and to Cyversity NYC for joining us as our community partner.

What Claude Code logs reveal about AI agent activity

AI logs in 2026 feel a lot like cloud logs did in 2019.

That was the starting point for Darwin’s talk. The tools keep changing, and so do their logs. At Monad, we’ve been working through what each source records, how to collect it, and which fields help with detection, response, and investigations.

A few takeaways from the session:

• Agents can reach beyond the chat window. Depending on their permissions and credentials, agents can read local files, run commands, and call cloud or SaaS APIs.
• Different logs answer different questions. Depending on the tool, platform audit logs can cover account, API key, and policy changes. Runtime events show tool calls and permission decisions. Transcripts capture prompts and responses. Endpoint logs help confirm which commands ran and which files changed.
• Collection needs to be in place first. Required plans, permissions, and settings vary by tool. Enabling client event collection afterward won’t recover events that were never recorded.
• Related events need to be connected. In Claude Code, session.id groups events from a session, prompt.id connects events associated with a prompt, and tool_use_id links a tool call’s permission decision with its result when the call runs.
• Blocked attempts matter, too. Claude Code records rejected calls in tool_decision, without a corresponding tool_result. Searching only tool results means missing those rejected attempts.

For the demo, Darwin asked Claude Code to copy a file containing fake credentials. He approved one attempt, rejected another, and let auto mode handle a third. He then walked through the logs from each run.

The morning after he ran those scenarios, Claude Code added classifier_verdict and permission_mode to its OpenTelemetry tool_decision events. Darwin got to update the slides and prove his own point about how quickly the logs change.

For more on the logging and collection setup, see our Claude Code detection engineering series: Part 1 and Part 2.

We appreciated everyone who came to the talk and kept the conversation going afterward. Get the “Following the AI Audit Trail” slides on GitHub, and we’ll share the recording when it’s available.

Getting the research into people’s hands

We gave away copies of our refreshed book, A Security Field Guide to AI Audit Trails, throughout the weekend. After all the research and writing, getting to hand it to people in person was especially rewarding.

It’ll be available on Amazon next week. Stay tuned for the link.

Thank you to Kenneth Kaye, Valerie Worman, Matt Jane, and Curtis Redgate for their contributions to the research and book.

And to the BSides NYC organizers, volunteers, and speakers: thank you for putting together a weekend where people at every stage of their careers could learn, share, and spend time together. We were glad to be part of it.

NYC, thank you for a great weekend.

‍