AI auto-instrumentation adds tracing to an application that calls language models without you editing its code, so you can see each model call, its duration and its tool use. With OpenTelemetry, prompt and response content is optional, and for good reason: it can contain sensitive data.
What is auto-instrumentation?
OpenTelemetry's documentation calls it zero-code instrumentation. It adds the OpenTelemetry API and SDK capabilities to an application, typically as an agent or agent-like installation. The mechanism depends on the language and ranges from bytecode manipulation to monkey patching to eBPF, which injects calls into your application.
It usually instruments the libraries you use, so requests and responses, database calls and message queue calls are covered. It does not typically instrument your own code, which needs code-based instrumentation. You configure it through environment variables and other language-specific mechanisms, and you need at least a service name to identify the service. The documentation lists automatic instrumentation for .NET, Go, Java, JavaScript, PHP and Python.
For AI applications, instrumentation libraries wrap the clients of model providers, so each model call becomes a span without a code change.
What does a model call record?
OpenTelemetry's GenAI semantic conventions define the data. They are maintained in a separate repository, and their spans document is marked at "Development" status, meaning the names and fields can still change. It defines span types for inference (a call to a model), embeddings, retrievals, memory operations and tool execution, plus separate conventions for agents and for metrics.
Standard attributes include the operation name, the model requested, token usage and finish reasons, which are enough to answer questions about latency, cost and failure causes.
Why is content opt-in?
The conventions treat prompt and completion content differently from the metadata. Attributes such as the input messages, the output messages, system instructions and the retrieval query text have a requirement level of opt-in, so they are not recorded by default. The specification warns that some attributes, such as the retrieval query text, may contain sensitive information. It also describes recording content on span attributes or uploading it to external storage.
This matters because a prompt can contain anything a user types: personal data, secrets pasted for help, internal documents retrieved for context. Writing that to a tracing backend copies it into a system with different access rules and retention.
What are the risks of turning it on?
Three, in order of likelihood. First, sensitive data lands in telemetry storage, where more people can read it than can read the source. Second, trace volume and cost grow quickly when payloads are large. Third, spans can reveal the structure of your system prompts and tools, which helps an attacker who gets read access to the trace store.
There is a positive side too. Tracing tool execution is how you find out what an agent actually did, which is essential for investigating incidents involving AI agents.
A constructed example
A support assistant calls a model with the user's message and a retrieved knowledge article. The team enables zero-code instrumentation and sees, for each request, the inference span, the retrieval span and two tool spans, with timings and token counts. A latency problem turns out to be a slow retrieval step. They leave content capture off. During an incident review, they need to know whether the agent called a refund tool, and the tool span shows the call without needing the customer's message.
How to check or apply this
- Enable auto-instrumentation in a staging environment first and review the spans produced.
- Keep prompt and response content capture off by default.
- If you need content for debugging, enable it for a short period, in a restricted environment, with redaction.
- Set retention and access controls on the trace store as you would for logs with personal data.
- Review attributes for sensitive data before sending traces to a third-party backend.
- Record tool calls and their parameters, with sensitive values masked.
- Because the conventions are in development status, pin library versions and expect field names to change.
Safeguard works on the safety side of the same problem, with guardrails and MCP Guardrail for tool calls from AI agents, which complement tracing: tracing shows what happened, guardrails limit what can happen.
Quick check
Does zero-code instrumentation record my own business logic?
Typically not. According to OpenTelemetry, it instruments the libraries you use, such as HTTP, database and messaging clients. Your own code needs code-based instrumentation.
Are prompts recorded by default?
In the GenAI semantic conventions, message content attributes are opt-in and the specification warns they may contain sensitive information.
Sources
Last reviewed: 18 October 2026.
