Methods, systems, and apparatus, including computer programs encoded on a computer storage medium, used to monitor behavior with respect to a software program. In one aspect, a method includes playing media content using a first program that is limited to a first security context corresponding to a first domain of the first program, the first program having an object in the first security context corresponding to the media content; receiving an event including information indicating a monitoring program; instantiating the monitoring program in a second security context that is applicable to multiple domains, including the first domain, the instantiated monitoring program having access from the second security context to the object of the first program in the first security context; and receiving from the monitoring program information regarding playing of the media content.