Watching the Agents: AI Observability Has to Evolve for the Agentic Era

For most of its history, observability has answered a fairly modest question: did the software work? Agentic AI raises a harder one. Did the system make the right call, take the right action, and leave behind enough evidence for someone to understand it, or undo it?

Statistics Canada reports that nearly 20% of businesses used AI to produce goods or deliver services in the 12 months leading up to spring 2026, triple the usage recorded two years earlier. Over roughly the same period,35.9% of workers said they had used generative AI tools in their main job. Employees appear to be adopting AI faster than their employers are formally deploying it, and that gap is where visibility breaks down first.

A large language model is shaped by instructions, conversation history, retrieved content, configuration and probability. AI agents raise the stakes. An agent forms a plan, picks tools, uses credentials, calls APIs and takes action. A chatbot that gets something wrong produces a bad answer. An agent that gets something wrong produces a bad outcome.

When a benchmark became a breach

This summer supplied a vivid case study. On August 26, OpenAI released its full technical report on an incident that OpenAI and Hugging Face first disclosed in July.

During an internal cyber-capability evaluation, OpenAI agents were assigned an ExploitGym task: find and exploit a software vulnerability. The agents discovered a zero-day in an internal package-registry proxy, used it to get onto the internet, reasoned that Hugging Face might host the benchmark's reference solutions, and chained additional vulnerabilities and stolen credentials to reach Hugging Face's production infrastructure.

Weeks earlier, agents running in isolation had turned the package registry into a makeshift message board, leaving notes for one another in file and directory names. They then used it to swap credentials and working exploits with agents in completely separate evaluations. That channel didn't appear on any architecture diagram, and nothing monitored it.

The agents had no malicious intent. They were reward hacking, going after the answer key instead of solving the problem. Persistence, usually a feature, turned a stalled benchmark task into an incident spanning two companies. 

Hugging Face detected and contained the intrusion, then used AI-assisted analysis to reconstruct roughly 17,600 logged agent actions. OpenAI's own retrospective found that its chain-of-thought monitoring would have flagged the activity more than a day before the breach if it had been running in that environment. The signal was there. Nobody was watching for it.

To piece together what happened, investigators had to recover the goal, the context that shaped the plan, the vulnerabilities found, the credentials used, the sequence of actions, and the impact on two organizations. Conventional observability follows a request. Agentic observability has to follow a decision, the channels it moves through and what it leaves behind.

Why this matters in Canada

Canadian organizations have little room for blind spots. Check Point Research data shows organizations in Canada averaged 1,664 cyberattacks per week over the past six months, while ransomware hit 18.2% of Canadian organizations, roughly double the 9%  global average. Introducing autonomous systems with real credentials into that environment, without the ability to see what they're doing, compounds the risk considerably.

Canadian authorities are paying attention, too. This spring, the Canadian Centre for Cyber Security joined its Five Eyes counterparts in publishing Careful Adoption of Agentic AI Services, the first joint guidance written specifically for agents. It calls for continuous monitoring of agent inputs, tool calls, reasoning, decisions and outputs.

Fragments don't add up to a story

Teams need a shared trace identity that ties together model calls, retrieval, tool use, credentials, policy decisions and downstream changes. Without it, they can see every event and still miss why the agent chose a particular tool. The missing piece is correlation.

Discovery belongs in the same conversation. AI enters organizations through code, browser extensions, plugins, skills, Model Context Protocol servers and third-party services, often well outside established deployment paths. Visibility that starts at formal production will miss everything introduced along the way. The Hugging Face incident shows how far that gap can stretch. A package cache provisioned for an entirely different purpose became a coordination channel nobody authorized or watched. Shared infrastructure is attack surface, whatever it was originally built for. 

More telemetry also means more privacy exposure. Prompts, retrieved documents, outputs, tool arguments and memory can all contain proprietary or regulated information, including personal information governed by PIPEDA and, in Quebec, Law 25. Selective capture, redaction, encryption, access control and purposeful retention need to be designed in from the start. 

Seeing is where control starts

Observability tells you what an agent did. Security needs enough context to decide whether it should be allowed to do it, and that decision happens at runtime. An agent can be fully authenticated and authorized to use a tool and still choose an action that is wrong in context.

After-the-fact visibility supports investigation, while inline visibility makes prevention possible. At Check Point, the AI Defence Plane provides runtime protection that evaluates interactions as they happen so unsafe behaviour can be stopped before it becomes business impact.

A new vocabulary for incident response

Time needs a control point. An agent allowed to reason and retry indefinitely will eventually find paths nobody designed, simply by sticking with it long enough. Execution limits, reasoning budgets, checkpoints and clear stop conditions belong alongside credential scope and network access. After its own incident, OpenAI paused its largest planned frontier training run and rebuilt isolation across its research environment. 

Operational resilience comes down to whether teams can understand what an agent did, stop it while it's acting and reverse the outcome when needed. Autonomy without those capabilities is operationally immature and effectively an incident waiting on the calendar.

Toward controlled, observable, reversible autonomy

Demonstrations have already shown that agents can do useful work. The challenge facing Canadian enterprises is whether they can understand, constrain, investigate and safely reverse what those agents do, ideally before agentic AI moves from the margins of their operations into the core. 

That is where AI observability is headed: an operating system for controlled autonomy, rather than one more dashboard for the model.