From 58d0721240d45cb64fe37b774e9fe21a0bc4cd75 Mon Sep 17 00:00:00 2001 From: OpenSourceSoul Date: Sun, 1 Feb 2026 16:16:12 +0000 Subject: [PATCH 1/3] fix: change trace_include_sensitive_data default to False for security By default, trace_include_sensitive_data was set to True, which meant sensitive data (tool inputs/outputs, LLM generations) was included in traces without explicit user consent. This is a security risk as it could lead to accidental data leakage of PII, secrets, or confidential info. This change makes the SDK secure-by-default: - Changed OPENAI_AGENTS_TRACE_INCLUDE_SENSITIVE_DATA env default from 'true' to 'false' - Changed VoicePipelineConfig.trace_include_sensitive_data default from True to False - Updated tests to reflect new secure-by-default behavior Users can still opt-in to include sensitive data by: 1. Setting OPENAI_AGENTS_TRACE_INCLUDE_SENSITIVE_DATA=true environment variable 2. Explicitly passing trace_include_sensitive_data=True to RunConfig or VoicePipelineConfig Security impact: Prevents accidental exposure of sensitive data in production deployments. --- src/agents/run_config.py | 2 +- src/agents/voice/pipeline_config.py | 7 ++++--- tests/test_run_config.py | 6 +++--- 3 files changed, 8 insertions(+), 7 deletions(-) diff --git a/src/agents/run_config.py b/src/agents/run_config.py index fc0eb2b17d..73428963d4 100644 --- a/src/agents/run_config.py +++ b/src/agents/run_config.py @@ -28,7 +28,7 @@ def _default_trace_include_sensitive_data() -> bool: """Return the default for trace_include_sensitive_data based on environment.""" - val = os.getenv("OPENAI_AGENTS_TRACE_INCLUDE_SENSITIVE_DATA", "true") + val = os.getenv("OPENAI_AGENTS_TRACE_INCLUDE_SENSITIVE_DATA", "false") return val.strip().lower() in ("1", "true", "yes", "on") diff --git a/src/agents/voice/pipeline_config.py b/src/agents/voice/pipeline_config.py index eed2ab6940..d0ffb2d865 100644 --- a/src/agents/voice/pipeline_config.py +++ b/src/agents/voice/pipeline_config.py @@ -22,9 +22,10 @@ class VoicePipelineConfig: tracing: TracingConfig | None = None """Tracing configuration for this pipeline.""" - trace_include_sensitive_data: bool = True - """Whether to include sensitive data in traces. Defaults to `True`. This is specifically for the - voice pipeline, and not for anything that goes on inside your Workflow.""" + trace_include_sensitive_data: bool = False + """Whether to include sensitive data in traces. Defaults to `False` for security. When enabled, + tool inputs/outputs and LLM generations may be exposed in traces. Only enable in trusted + environments.""" trace_include_sensitive_audio_data: bool = True """Whether to include audio data in traces. Defaults to `True`.""" diff --git a/tests/test_run_config.py b/tests/test_run_config.py index 31d6d0a46a..059da1b43a 100644 --- a/tests/test_run_config.py +++ b/tests/test_run_config.py @@ -88,11 +88,11 @@ async def test_agent_model_object_is_used_when_present() -> None: assert result.final_output == "from-agent-object" -def test_trace_include_sensitive_data_defaults_to_true_when_env_not_set(monkeypatch): - """By default, trace_include_sensitive_data should be True when the env is not set.""" +def test_trace_include_sensitive_data_defaults_to_false_when_env_not_set(monkeypatch): + """By default, trace_include_sensitive_data should be False for security when the env is not set.""" monkeypatch.delenv("OPENAI_AGENTS_TRACE_INCLUDE_SENSITIVE_DATA", raising=False) config = RunConfig() - assert config.trace_include_sensitive_data is True + assert config.trace_include_sensitive_data is False @pytest.mark.parametrize( From 5475fb2a6e8c23fcc7075df58c53e4fd3ddc2f45 Mon Sep 17 00:00:00 2001 From: Sylvester Kaczmarek <16242628+sylvesterkaczmarek@users.noreply.github.com> Date: Fri, 21 Aug 2026 01:02:32 +0100 Subject: [PATCH 2/3] docs: document sensitive tracing opt-in --- docs/tracing.md | 23 ++++++++++++++++------- 1 file changed, 16 insertions(+), 7 deletions(-) diff --git a/docs/tracing.md b/docs/tracing.md index d73a644209..16d86ae989 100644 --- a/docs/tracing.md +++ b/docs/tracing.md @@ -87,7 +87,7 @@ app = FastAPI() def process_in_background(prompt: str) -> None: try: - with trace("background_job"): + with trace("celery_task"): Runner.run_sync(agent, prompt) finally: flush_traces() @@ -106,6 +106,7 @@ async def run(prompt: str, background_tasks: BackgroundTasks): Sometimes, you might want multiple calls to `run()` to be part of a single trace. You can do this by wrapping the entire code in a `trace()`. ```python +import asyncio from agents import Agent, Runner, trace async def main(): @@ -139,11 +140,19 @@ Spans are automatically part of the current trace, and are nested under the near Certain spans may capture potentially sensitive data. -The `generation_span()` stores the inputs/outputs of the LLM generation, and `function_span()` stores the inputs/outputs of function calls. These may contain sensitive data, so you can disable capturing that data via [`RunConfig.trace_include_sensitive_data`][agents.run.RunConfig.trace_include_sensitive_data]. +The `generation_span()` stores the inputs/outputs of the LLM generation, and `function_span()` stores the inputs/outputs of function calls. These may contain sensitive data, so you can control capturing that data via [`RunConfig.trace_include_sensitive_data`][agents.run.RunConfig.trace_include_sensitive_data]. Similarly, Audio spans include base64-encoded PCM data for input and output audio by default. You can disable capturing this audio data by configuring [`VoicePipelineConfig.trace_include_sensitive_audio_data`][agents.voice.pipeline_config.VoicePipelineConfig.trace_include_sensitive_audio_data]. -By default, `trace_include_sensitive_data` is `True`. You can set the default without code by exporting the `OPENAI_AGENTS_TRACE_INCLUDE_SENSITIVE_DATA` environment variable to `true/1` or `false/0` before running your app. +By default, `trace_include_sensitive_data` is `False`. Applications that intentionally need model and tool inputs/outputs in traces must opt in explicitly, either in code: + +```python +from agents import RunConfig + +run_config = RunConfig(trace_include_sensitive_data=True) +``` + +or by exporting `OPENAI_AGENTS_TRACE_INCLUDE_SENSITIVE_DATA=true` (also accepts `1`, `yes`, or `on`). Setting the option explicitly is recommended for applications migrating from releases where sensitive trace data was included by default. ## Custom tracing processors @@ -154,7 +163,7 @@ The high level architecture for tracing is: To customize this default setup, to send traces to alternative or additional backends or modifying exporter behavior, you have two options: -1. [`add_trace_processor()`][agents.tracing.add_trace_processor] lets you add an **additional** trace processor that will receive traces and spans as they are ready. This lets you do your own processing in addition to sending traces to OpenAI's backend. +1. [`add_trace_processor()`][agents.tracing.add_trace_processor] lets you add an **additional** trace processor that will receive traces as they are ready. This lets you do your own processing in addition to sending them to OpenAI's backend. 2. [`set_trace_processors()`][agents.tracing.set_trace_processors] lets you **replace** the default processors with your own trace processors. This means traces will not be sent to the OpenAI backend unless you include a `TracingProcessor` that does so. @@ -212,14 +221,14 @@ The following community and vendor integrations support the tracing API surface - [Pydantic Logfire](https://logfire.pydantic.dev/docs/integrations/llms/openai/#openai-agents) - [AgentOps](https://docs.agentops.ai/v1/integrations/agentssdk) - [Scorecard](https://docs.scorecard.io/docs/documentation/features/tracing#openai-agents-sdk-integration) -- [Respan](https://respan.ai/docs/integrations/tracing/openai-agents-sdk) -- [LangSmith](https://docs.smith.langchain.com/observability/how_to_guides/trace_with_openai_agents_sdk) +- [Respan](https://respan.ai/docs/integrations/openai-agents) +- [LangSmith](https://docs.smith.langchain.com/observability/how_to_guides/trace_with_openai_agents) - [Maxim AI](https://www.getmaxim.ai/docs/observe/integrations/openai-agents-sdk) - [Comet Opik](https://www.comet.com/docs/opik/tracing/integrations/openai_agents) - [Langfuse](https://langfuse.com/docs/integrations/openaiagentssdk/openai-agents) - [Langtrace](https://docs.langtrace.ai/supported-integrations/llm-frameworks/openai-agents-sdk) - [Okahu-Monocle](https://github.com/monocle2ai/monocle) -- [Galileo](https://v2docs.galileo.ai/integrations/openai-agent-integration#openai-agent-integration) +- [Galileo](https://v2docs.galileo.ai/integrations/openai-agent-integration#openai-agents) - [Portkey AI](https://portkey.ai/docs/integrations/agents/openai-agents) - [LangDB AI](https://docs.langdb.ai/getting-started/working-with-agent-frameworks/working-with-openai-agents-sdk) - [Agenta](https://docs.agenta.ai/observability/integrations/openai-agents) From 8c5cdcb00067d85145f3519f7d23542a6480c12c Mon Sep 17 00:00:00 2001 From: Sylvester Kaczmarek <16242628+sylvesterkaczmarek@users.noreply.github.com> Date: Fri, 21 Aug 2026 01:03:20 +0100 Subject: [PATCH 3/3] docs: keep sensitive tracing migration change scoped --- docs/tracing.md | 11 +++++------ 1 file changed, 5 insertions(+), 6 deletions(-) diff --git a/docs/tracing.md b/docs/tracing.md index 16d86ae989..b9cc14a22d 100644 --- a/docs/tracing.md +++ b/docs/tracing.md @@ -87,7 +87,7 @@ app = FastAPI() def process_in_background(prompt: str) -> None: try: - with trace("celery_task"): + with trace("background_job"): Runner.run_sync(agent, prompt) finally: flush_traces() @@ -106,7 +106,6 @@ async def run(prompt: str, background_tasks: BackgroundTasks): Sometimes, you might want multiple calls to `run()` to be part of a single trace. You can do this by wrapping the entire code in a `trace()`. ```python -import asyncio from agents import Agent, Runner, trace async def main(): @@ -163,7 +162,7 @@ The high level architecture for tracing is: To customize this default setup, to send traces to alternative or additional backends or modifying exporter behavior, you have two options: -1. [`add_trace_processor()`][agents.tracing.add_trace_processor] lets you add an **additional** trace processor that will receive traces as they are ready. This lets you do your own processing in addition to sending them to OpenAI's backend. +1. [`add_trace_processor()`][agents.tracing.add_trace_processor] lets you add an **additional** trace processor that will receive traces and spans as they are ready. This lets you do your own processing in addition to sending traces to OpenAI's backend. 2. [`set_trace_processors()`][agents.tracing.set_trace_processors] lets you **replace** the default processors with your own trace processors. This means traces will not be sent to the OpenAI backend unless you include a `TracingProcessor` that does so. @@ -221,14 +220,14 @@ The following community and vendor integrations support the tracing API surface - [Pydantic Logfire](https://logfire.pydantic.dev/docs/integrations/llms/openai/#openai-agents) - [AgentOps](https://docs.agentops.ai/v1/integrations/agentssdk) - [Scorecard](https://docs.scorecard.io/docs/documentation/features/tracing#openai-agents-sdk-integration) -- [Respan](https://respan.ai/docs/integrations/openai-agents) -- [LangSmith](https://docs.smith.langchain.com/observability/how_to_guides/trace_with_openai_agents) +- [Respan](https://respan.ai/docs/integrations/tracing/openai-agents-sdk) +- [LangSmith](https://docs.smith.langchain.com/observability/how_to_guides/trace_with_openai_agents_sdk) - [Maxim AI](https://www.getmaxim.ai/docs/observe/integrations/openai-agents-sdk) - [Comet Opik](https://www.comet.com/docs/opik/tracing/integrations/openai_agents) - [Langfuse](https://langfuse.com/docs/integrations/openaiagentssdk/openai-agents) - [Langtrace](https://docs.langtrace.ai/supported-integrations/llm-frameworks/openai-agents-sdk) - [Okahu-Monocle](https://github.com/monocle2ai/monocle) -- [Galileo](https://v2docs.galileo.ai/integrations/openai-agent-integration#openai-agents) +- [Galileo](https://v2docs.galileo.ai/integrations/openai-agent-integration#openai-agent-integration) - [Portkey AI](https://portkey.ai/docs/integrations/agents/openai-agents) - [LangDB AI](https://docs.langdb.ai/getting-started/working-with-agent-frameworks/working-with-openai-agents-sdk) - [Agenta](https://docs.agenta.ai/observability/integrations/openai-agents)