# Investigating Claude Misuse: Evidence Sources & Retention

> Where Claude evidence lives, how long it is kept (6 years, 180 days, 30 days, 24 hours), the Team-plan gap, and five places to start an investigation.

Source: https://playciso.com/blog/claude-forensics-evidence-sources · Published: 2026-11-01 · Publisher: PlayCISO (https://playciso.com)

Primary source: https://github.com/invictus-ir

---

**Could you work out what Claude did in your organisation last month?** Who asked it for what, which files it read, which tools it ran and whether anything left the building? The honest answer for most teams is "partly". It depends on your Claude plan, how Claude is deployed, and whether you switched evidence collection on _before_ the incident. That is the central finding of **Frontier Forensics: Anthropic**, a guide published by Invictus Incident Response in October 2026. **Who this is for:** CISOs, incident responders and platform owners running Claude Enterprise or Team, the Claude Platform (API and Console), Claude Code or Claude Cowork. _Independent summary of the Invictus report, which synthesises Anthropic's documentation as reviewed in October 2026. Each product fact links to the Anthropic page the report cites. PlayCISO is not affiliated with Anthropic or Invictus. Settings and retention can change: check the linked documentation before you rely on a number._ ## Why this matters: three incidents found months later In July 2026 Anthropic disclosed three incidents found by a retrospective review of its cybersecurity evaluation runs ([Anthropic: Investigating three real-world incidents in our cybersecurity evaluations](https://www.anthropic.com/news/investigating-incidents-cybersecurity-evals)). As the Invictus report summarises it, evaluation environments believed to be isolated had unintended internet access. In one incident, Claude published a malicious Python package to PyPI while pursuing a capture-the-flag objective. The package was public for roughly **one hour** and was downloaded and run on **15 real systems**. One was a security company's scanner, which installed the package and exposed that company's credentials. The earliest activity dated to **April 2026**; Anthropic began its review on **23 July 2026**. Anthropic said it generally stores traces for benchmark evaluations, which is what made a review months later possible. The two affected organisations Anthropic reached **had not detected the activity themselves**, and Anthropic noted that a review of network logs would have surfaced it. We covered the incident itself in [AI agent published real malware to PyPI](/blog/ai-agent-published-malware-pypi-no-human). The report's lesson in one line: evidence that was retained can be reviewed later; evidence that was never retained cannot be recovered. ## The three rings of Claude evidence Invictus groups Claude evidence into three locations around an incident. You usually need all three. RingWhat it holdsWho controls it **1. Records retained by Anthropic**The [Compliance API](https://platform.claude.com/docs/en/manage-claude/compliance-api): the [Activity Feed](https://platform.claude.com/docs/en/manage-claude/compliance-activity-feed), retained chat, file and project content, and Claude Code and Cowork [session transcripts](https://platform.claude.com/docs/en/manage-claude/compliance-sessions); the Enterprise [CSV audit export](https://support.claude.com/en/articles/9970975-access-audit-logs); and stored Claude Platform feature data (Files, batch results, code execution data, Managed Agents sessions).Anthropic holds it; you collect it. **2. Telemetry exported to your systems**[Claude Code OpenTelemetry](https://code.claude.com/docs/en/monitoring-usage) and [Cowork OpenTelemetry](https://support.claude.com/en/articles/14477985-monitor-claude-cowork-activity-with-opentelemetry); inference hook security-server records on Enterprise.You, and only if configured in advance. **3. Endpoints and applications**Claude Code files and configuration ([the .claude directory](https://code.claude.com/docs/en/claude-directory)), application-side API request and response logs, and supporting records such as EDR.You. The Activity Feed records authentication, credential creation, role changes, object access and changes to organisational controls, covering identities, workspaces, connectors, settings and content access. It is collected with `GET /v1/compliance/activities` ([API reference](https://platform.claude.com/docs/en/api/compliance/activities/list)). Customer telemetry adds the detail Anthropic's records lack: host, repository, tool, approval and content. Correlate Cowork OTel with `prompt.id`, and Claude Code OTel with `tool_use_id` and `request_id`, which also lead into session transcripts. ## Retention at a glance Four windows are fixed. Most of the rest is yours to set, which means it is also yours to get wrong. SourceRetention (per the report)Watch out for Activity Feed**6 years** from when the feed is first enabledNo backfill: nothing before enablement exists Enterprise CSV audit exportLookback of up to **180 days**Narrower than the Activity Feed, no chat or project content, unavailable with customer-managed encryption keys (CMEK) CSV download link**24 hours** after exportSave the file at once Claude Code local files**30 days** by default (`cleanupPeriodDays`)Applies to transcripts and several other paths; `history.jsonl`, auto memory and Desktop or Cowork transcripts follow different rules Chat, file and project contentSet by configurationYour [retention settings](https://privacy.claude.com/en/articles/10440198-configure-custom-data-retention-controls-for-enterprise-plans) and object deletion policy Claude Code and Cowork session transcriptsSet by configurationDepends on authentication and hosting; ZDR and HIPAA configurations, for example, can exclude sessions Claude Code and Cowork OTelSet by configurationYour telemetry destination and storage Inference hook recordsSet by configurationThe [security server](https://platform.claude.com/docs/en/manage-claude/inference-hooks)'s logging; does not capture Claude's final response Application-side API logsSet by configurationOnly what your app recorded ([API and data retention](https://platform.claude.com/docs/en/manage-claude/api-and-data-retention)) Want to feel how fast these close? [Evidence Expiry Race](/tools/evidence-expiry-race) puts the windows on a clock. ## The Team-plan gap Per the report, **Claude Team lacks the Compliance API and the CSV audit export**. A Team investigation has no Anthropic-held Activity Feed to lean on, so it depends on Claude Code and Cowork OpenTelemetry (available on Team, if you configured it), endpoint artefacts, and records from your identity provider and connected systems. If you are on Team and handle sensitive work, set up telemetry and endpoint collection now, or weigh that gap in your plan choice. ## Collect with a read-only key Anthropic-held content is retrieved with a [Compliance Access Key](https://platform.claude.com/docs/en/manage-claude/compliance-content-data), and its scopes are set at creation. The report's advice: collect with `read:compliance_user_data` **only**. The separate `delete:compliance_user_data` scope permits permanent deletion of supported Anthropic-held content, and "a compromised key with deletion rights could be used to destroy content relevant to an investigation." Deletion does not necessarily erase Activity Feed records or independently retained copies, so do not treat it as removal of all evidence either way. ## API prompts need your own logs If you build on the Claude API, the prompts and responses your application exchanges are **not** available as conversation history through the Compliance API. Your application's logs may be the only record of what an internal assistant sent to Claude and what came back. Capture the identifiers that link each request to its response and to the user, session or job that triggered it, and confirm early what is logged and how long it is kept. ## Five places to start an investigation The report scopes Claude investigations from five starting points. Start from the environment under investigation (claude.ai, Claude Platform, Claude Code or Cowork), then corroborate with identity provider, repository, cloud, SaaS and MCP server logs. Practise choosing in the [AI Investigation Scoping Lab](/tools/ai-investigation-scoping-lab). Starting pointThe questionFirst evidence to pull (examples from the report) 1. Account compromiseDid a threat actor gain access, and what followed?Sign-ins such as `sso_login_*`, `social_login_succeeded`, `magic_link_login_*`; pivot on the actor to chat, file and project activity 2. Persistence and privilege escalationDid the actor obtain a foothold?Invitations, role and group changes, SCIM, `mcp_server_created`, `mcp_server_updated`, `desktop_extension_uploaded`; local settings, MCP configuration and hooks 3. Defence evasionDid the actor weaken visibility or enforcement?`org_ip_restriction_*`, `mcp_tool_policy_updated`, `org_connector_domain_guard_updated`, `org_cowork_*`; telemetry settings, `bypassPermissions`, `dangerouslyDisableSandbox`, `permission_mode_changed` 4. Data exposureWhat reached Claude or a connected system, and where could it leave?Chat, file and project content, export and sharing activity, each connected service's record; app-side logs and Files API objects 5. Agent abuseWhat did the agent attempt, who started it, and what executed?Remote Cowork sessions and `started_by_user`; inference hook denials, fail-open events and circuit-breaker trips; local tool decisions with their approval source Two of these are hands-on in our labs: hunt starting point 3 in the [Agent Defence-Evasion Hunt](/tools/agent-defense-evasion-hunt), and for starting point 2 on the endpoint, the report warns that configuration and memory files can contain instructions injected to influence an agent. Practise spotting them in the [Poisoned Instruction File Lab](/tools/poisoned-instruction-file-lab). ## What to set up this quarter - Enable the Compliance API and Activity Feed if you are on Enterprise. The six-year clock starts at enablement and there is no backfill (set up the Compliance API). - Create a read-only collection key (read:compliance_user_data) and keep delete:compliance_user_data off any key used for collection. - Pull the Activity Feed into your SIEM on a schedule, and alert on the defence-evasion events listed above. - If you depend on the CSV export, know its limits: 180 days, no chat or project content, no CMEK, and a link that dies in 24 hours. - Configure Claude Code and Cowork OpenTelemetry to a collector you control (Cowork monitoring reference), retain it, and keep prompt.id, tool_use_id and request_id. - Write the endpoint acquisition step into your playbook: the user's ~/.claude directory, ~/.claude.json and project configuration and instruction files, collected before the 30-day default cleanup. - Log API traffic in your own applications, with identifiers linking request, response and the user, session or job. - Retain inference hook security-server records if you use inference hooks. - Keep network and egress logs. In Anthropic's evaluation incidents, network logs would have surfaced the problem. - On Team, compensate for the missing Compliance API with telemetry, identity provider and endpoint collection. - Test it. Run the AI Evidence Readiness check and confirm you can actually retrieve each source. ## FAQ ### Can you investigate misuse of Claude in your organisation? Only partly, unless you prepared. Invictus Incident Response's Frontier Forensics report says the answer depends on the Claude plan, how Claude is deployed, and whether evidence collection was configured before the incident. Evidence comes from three places: records Anthropic retains, telemetry you export to your own systems, and files on your endpoints and in your applications. You need all three to reconstruct what happened. ### How long does Anthropic keep Claude Enterprise audit logs? Per the report, Anthropic retains Activity Feed records for six years from when the feed is first enabled, and nothing before enablement can be backfilled. The Enterprise CSV audit export, the fallback when the Compliance API was not enabled, has a lookback of up to 180 days, and its download link expires after 24 hours. ### Does the Claude Team plan have audit logs or a Compliance API? According to the report, Claude Team has neither the Compliance API nor the CSV audit export. Team investigations therefore lean on OpenTelemetry from Claude Code and Cowork (available on Team and Enterprise, if configured in advance), endpoint artefacts, and records from the identity provider and connected systems. ### Where does Claude Code store logs on a laptop, and for how long? The report says Claude Code keeps session transcripts, tool results, prompt history and file snapshots locally, with configuration in the user's ~/.claude directory, ~/.claude.json, .mcp.json, hooks, plugins and instruction files such as CLAUDE.md. The cleanupPeriodDays setting defaults to 30 days and applies to transcripts and several other paths; history.jsonl, auto memory and Desktop or Cowork transcripts follow different rules. Acquire these early. ### Are Claude API prompts and responses available through the Compliance API? No. The report's seventh finding is that ordinary API prompts and responses need application-side logging and are not available as conversation history through the Compliance API. If your app does not log the request, the response and which user, session or job triggered it, that record may not exist anywhere you can reach. ### What scope should a Compliance API collection key have? Read only: read:compliance_user_data. The report warns that the separate delete:compliance_user_data scope permits permanent deletion of supported Anthropic-held content, so a compromised key with deletion rights could be used to destroy content relevant to an investigation. Deletion does not necessarily erase Activity Feed records or independently retained copies. ## Sources - Invictus Incident Response: Frontier Forensics: Anthropic, v1.0, October 2026 (TLP:CLEAR): evidence sources, retention, scoping starting points and cheat sheet. - Anthropic: Investigating three real-world incidents in our cybersecurity evaluations - Anthropic: Compliance API overview · Set up the Compliance API · Query the Activity Feed · Compliance activities API reference - Anthropic: Retrieve session transcripts · Retrieve and delete chats, files, and projects · Compliance API FAQ - Anthropic: Access audit logs · Configure custom data retention controls for Enterprise plans · API and data retention - Anthropic: Claude Code monitoring · Explore the .claude directory - Anthropic: Monitor Claude Cowork activity with OpenTelemetry · Cowork monitoring reference - Anthropic: Inference hooks _This article is educational guidance for security leaders, not legal advice or a forensic procedure. Retention and plan features are as the Invictus report describes Anthropic's documentation in October 2026._