Google has introduced Agent Anomaly Detection in private preview for the Gemini Enterprise Agent Platform. The system inspects agent traces for suspicious behavior and can trigger a response before later actions run. Because the inspection is asynchronous, it is a monitoring layer, not a guarantee that the first harmful action will be blocked.
The preview supports agents built with Agent Development Kit version 1.2 or later. Google describes coverage for selected risks from the OWASP Agentic Top 10, plus abnormal resource or token escalation. Findings can flow into Security Command Center with a severity, explanation and suggested response.
The detection pipeline starts after telemetry exists
- An agent receives a task and begins reasoning.
- The runtime records logs, tool calls, traces and OpenTelemetry signals.
- Agent Anomaly Detection inspects the collected behavior asynchronously.
- A finding is created with severity and supporting context.
- A response API can stop or restrict subsequent actions.
This architecture keeps security analysis out of the live request path. That can protect agent latency, but it creates a timing boundary. If the first suspicious tool call already sent data or changed an external system, stopping the next call does not reverse the first one.
What evidence the detector can inspect
| Signal | What it can reveal | Blind spot |
|---|---|---|
| Reasoning traces | Unexpected goals, instruction conflicts or manipulation | Only what the platform records |
| Tool calls | Unusual destinations, arguments or action sequences | Off-platform work without telemetry |
| Logs and OpenTelemetry | Cross-service timing and resource patterns | Missing or inconsistent instrumentation |
| Token escalation | Runaway loops or abnormal prompt growth | Legitimate long tasks can look unusual |
| Resource escalation | Unexpected compute or service use | Novel attacks may resemble normal peaks |
OWASP coverage is selective, not comprehensive
Google says the product detects selected behaviors related to the OWASP Agentic Top 10. That wording should be preserved. It does not claim complete coverage of every category, every attack variation or every custom business rule.
Custom business-logic detections are described as coming soon. Until they arrive, organizations still need deterministic controls for high-value operations, such as payment limits, data export restrictions, approval gates and per-tool authorization.
The first-action gap defines the response design
An asynchronous detector works best when sensitive actions already require a checkpoint. A transfer, deletion or public upload can be placed behind an approval gate, giving the detector time to evaluate the preceding behavior. Low-risk read actions can remain fast, while irreversible steps wait for policy and anomaly checks.
Our AgentCore OAuth consent analysis explains the identity side of that boundary. The Grok Bot approval-boundary guide shows why human confirmation needs an exact action, destination and scope.
Security Command Center makes the finding operational
A useful anomaly system needs more than a warning. Google’s integration can place findings in Security Command Center with severity, an explanation and recommended action. Teams should enrich each finding with the agent identity, user, project, model, tools, affected resources and the exact trace interval.
- Notify an operator for medium-confidence behavior.
- Pause the agent when risk and confidence cross a defined threshold.
- Revoke a tool token when a credential path looks compromised.
- Quarantine the trace and related artifacts for investigation.
- Require human approval before any retry.
Four numbers are missing from the preview
Google has not published false-positive rate, false-negative rate, detection latency or pricing benchmarks for the preview. Those values determine whether the product can protect a real workflow without flooding operators or reacting too late.
A preview evaluation should create a labeled set of normal and adversarial traces, then measure all four. Teams should also test how often an investigation produces enough context to make a decision, because a correct alert with weak evidence can still be expensive to handle.
A rollout test for one agent workflow
- Select one agent with visible tool calls and a reversible action set.
- Instrument every action with consistent trace and identity fields.
- Replay normal traffic to establish an operational baseline.
- Inject prompt manipulation, looping and abnormal token growth.
- Measure time from suspicious action to finding and response.
- Review every miss and false alarm before expanding scope.
The practical verdict
Agent Anomaly Detection gives Gemini Enterprise teams a trace-aware security signal and a route into centralized incident response. Its asynchronous design is useful for oversight, but it works best beside preventive permissions and approval gates. The preview should be judged by measured detection quality and response time, not by the presence of an anomaly label alone.
Primary source
Checked September 17, 2026. Product scope and preview status come from Google. Timing analysis, blind spots and rollout tests are MustHave.ai analysis.
