Claude's Compliance API Now Covers Claude Code. Nothing Covers What Your Harness Sent.

Anthropic shipped consolidated session transcripts for Cowork and Claude Code on August 11. A week earlier, someone pointed a proxy at GitHub Copilot and found the traffic no transcript describes.

Two announcements a week apart, from two companies that were not talking to each other, describe the same hole from opposite sides.

On August 11, Anthropic extended its Compliance API to cover Cowork and Claude Code. Security teams can now pull a consolidated, server-hosted transcript for every session: prompts, responses, tool calls, skills, artifacts, all in one record, using the Compliance Access Key they already had.

On August 4, an engineer named Rafael put GitHub Copilot behind mitmproxy and watched what left his laptop. A fake secret he had typed into a .env file showed up in a completion request that he triggered by typing in a completely different file. He had already disabled Copilot for .env. It did not matter, because the request came from somewhere else.

Put those side by side and you get the shape of agent observability in August 2026. The transcript records the conversation. The harness assembles the conversation. Those are different systems, and only one of them is getting audit tooling.

The thing being logged is not the thing being sent

Here is the position this whole piece rests on: an agent transcript is a record of what arrived at the model, reconstructed on the server. It is not a record of what your client decided to attach.

That distinction sounds pedantic until you look at where secrets actually escape. They do not escape because someone pasted an API key into a chat box. That happens, and a transcript catches it. They escape because a context assembler on your machine made a reasonable-looking decision about which files were relevant, and one of those files had a credential on line four.

Anthropic's expansion is real and useful. I want to be clear about that before I complain about the category. Consolidated session records with tool activity in them solve a problem I have personally lost afternoons to, which is reconstructing what an agent actually did from four different log sources with mismatched timestamps. Getting prompts, responses, and tool calls back as one object, keyed to a verified user ID and email, is the difference between an investigation and a guess.

But read the coverage list carefully, because the exclusions are where large deployments live.

What the Compliance API actually returns

The new session endpoints return two things per session.

Session content covers prompts and responses, tool call content for web and MCP tools, and skills and artifacts content captured as transcript text. Session metadata covers a verified user ID and email address, the organization ID, session and per-message IDs, and timestamps.

The endpoints are additive. If you already pull Claude chat data, nothing about that changes, and if you already export OpenTelemetry data, Anthropic says the two can run side by side with no extra infrastructure on your end.

Now the gaps. The beta does not include Claude Code on the web, Claude Code accessed through the Claude Platform, or any session running on Amazon Bedrock, Google Cloud's Vertex AI, or Microsoft Foundry. It is Claude Enterprise only.

Sit with that last group for a second. Bedrock, Vertex, and Foundry are precisely where a regulated organization routes its model traffic, because that is how the data residency and procurement story gets told to the auditors in the first place. The audit surface that just shipped covers the deployment shape that needs it least.

Notice also what the content field says: tool call content for web and MCP. A Claude Code session that reads twelve local files, runs a build, and edits three of them is doing most of its work through a class of tool the description does not name. I would not assume that local file and shell activity comes back in the same shape as an MCP call until you have pulled a real session record and looked at it.

What the harness does that no transcript shows

The Copilot investigation is the counterweight, and it is worth reading in full because the method is more valuable than the finding.

Rafael routed VS Code through mitmproxy, trusted the local CA, and watched the bootstrap traffic before typing anything. Auth, config and policy, MCP registry, model discovery. Then a request to /models/session/intent, which scores your prompt against intents like code-gen, debugging, and tool-use to pick a model. All documented behavior, all more interesting to watch happen than to read about.

Then he dropped a fake token into a .env file, opened an unrelated pyproject.toml, and started typing. The completion request that went out carried the .env line in its context array, under a header that reads "These are recently edited files."

He traced it to recentEdits.tsx in the VS Code source. The default sliding window is hardcoded: up to 20 files, 8 edit summaries, and 3 lines of context around each change. That is how a line you did not touch, in a file you closed, ends up in an HTTP request.

There is an exclusion gate. It is tied to a repository policy, which is a Business and Enterprise GitHub feature under admin control. On an individual plan, nothing treats .env as special, and nothing reads your workspace's .gitignore.

The second finding is stranger. Copilot's Chronicle feature keeps a local SQLite database at session-store.db with your prompts and the model's responses in it. Rafael found the turns table, checked the write path in sessionStore.ts, and found no redaction, no masking, no secret filtering. Values bind straight through:

INSERT INTO turns (session_id, turn_index, user_message, assistant_response, timestamp)
VALUES (?, ?, ?, ?, ?)

His own framing is the honest one, and better than the alarmist version: the plaintext storage is not a bug or a missed edge case, it is what the code does. Nothing was ever built to prevent it. And the model can query that history through a session_store_sql tool, which he confirmed by asking "what did I work on this week?" and watching the SQL fly.

His conclusion lands where mine does. AI coding tools are becoming stateful systems that combine workspace, recent edits, conversations, tools, history, and model routing. Every new source of context makes the tool better and widens the set of developer state the system can reach.

Put this into practice

None of this requires an enterprise plan or a security team. The most useful thing you can do this week takes about twenty minutes.

1. Watch your own traffic. Install mitmproxy (brew install mitmproxy on macOS), run mitmweb, then point your editor at http://localhost:8080, uncheck strict SSL, and set proxy support to override so extensions route through it. Restart the editor. If nothing shows up, your extension host process is stale: run "Developer: Restart Extension Host" from the command palette and check the PIDs with ps -eo pid,ppid,lstart,command | grep -i -E "copilot|extensionHost|Code Helper".

2. Run the secret test yourself. Put a fake, obviously-labeled token in a .env file. Save it. Open an unrelated file in the same project and type a few lines. Then search the captured flows for that token string. Do this with your actual tool and your actual plan, because the answer depends on both.

3. Look for a local session store. Copilot's lives at ~/Library/Application Support/Code/User/globalStorage/github.copilot-chat/session-store.db on macOS. Open it with sqlite3 and run SELECT substr(user_message,1,60) FROM turns LIMIT 5;. Whatever your tool is, find out whether it keeps a conversation history on disk and what shape that history is in.

4. Check whether exclusions exist on your plan before you rely on them. Content exclusion in Copilot is an admin-controlled repository policy. If you are on an individual plan, you do not have it, and turning off completions for a file type does not stop that file's contents from riding along in someone else's request.

5. If you are on Claude Enterprise, pull one real session record. Not the docs, an actual record from an actual Claude Code session where you know what happened. Diff what came back against what you remember doing. That comparison tells you more about your audit coverage than any feature list, and it is the only way to find out how local tool activity is represented.

The lowest-friction version of all five: get secrets out of the workspace entirely. If the credential is not in a file the assembler can reach, none of the sliding-window behavior matters. Several people in the Hacker News thread pointed at credential brokers that inject placeholders and swap in real values at the network boundary, which is a better shape than hoping an exclusion list holds.

Honest limitations

The Copilot findings come from one researcher, on one machine, on one plan, on a specific build, in early August 2026. Client behavior changes weekly. The hardcoded window numbers were read from open source, so those are checkable, but a finding about what your install does is only a finding about your install.

The MitM method has its own boundary. It shows you one client's traffic on a machine you own, which is fine and legal on your own hardware, and tells you nothing about traffic that never crosses the proxy. Someone in the thread pointed out that eBPF uprobes get you the plaintext before encryption, which sidesteps certificate pinning entirely. That is a better technique and a much bigger commitment.

On the Anthropic side: this is a beta, on one plan tier, and I have not pulled records from it. Everything above about the coverage gaps comes from the announcement text, not from testing. The consolidated transcript could be excellent and the exclusions could close next quarter. Both would be good outcomes and neither would change the structural point.

The structural point itself has a counterargument worth stating. You could reasonably say the harness is supposed to send recently edited files, that this is the entire product, and that a tool which only ever saw the current buffer would be worse at its job. That is true. Context assembly is where these tools compete now. My objection is not that the harness collects, it is that the collection is invisible to the same teams who just got a consolidated transcript and will reasonably assume it covers them.

What I'd watch next

The interesting question is not whether Anthropic closes its beta gaps. It will.

The interesting question is whether anyone ships harness-side telemetry that a compliance team can actually read: a record of which files the assembler pulled, which were excluded and why, and what the exclusion policy was at the moment of the request. That log does not exist in any tool I know of, in any tier, from any vendor. Right now the only way to get it is to sit in the middle of your own traffic with a proxy.

If you run that proxy against a tool I did not mention here, Cursor, Codex, Amp, whatever you actually use, I want to know what came out. Especially the boring part: what got attached that you did not ask for.

Sources: Anthropic, Compliance API coverage extends to Claude Cowork and Claude Code (Aug 11, 2026); Compliance API documentation; Rafael, "I put GitHub Copilot Behind a MITM Proxy" (Aug 4, 2026); Hacker News discussion; microsoft/vscode recentEdits.tsx; microsoft/vscode sessionStore.ts.