Each new model generation makes AI agents more capable, more autonomous, and cheaper to run. Teams are putting them to work on real business tasks: issuing refunds, updating records, calling internal tools on a user's behalf. But a more capable model is not automatically a safer one. The more decisions an agent makes at runtime, the more its risk shifts from its code to its behavior. The real damage often happens in sessions that look benign on the surface: the agent returns a clean answer and closes the ticket, and only afterward do you notice it reached for a tool it should never have touched, or acted on a request that quietly widened its own access. Because nothing failed outright, the session clears the usual metrics-based evaluations without any second look.

That gap is exactly what Agent Anomaly Detection is built to close. It's now in Private Preview on the Gemini Enterprise Agent Platform.

What is Agent Anomaly Detection?

Agent Anomaly Detection is a reasoning-based oversight and audit layer for autonomous agents deployed on the Gemini Enterprise Agent Platform. It examines what an agent actually does using its reasoning traces, tool calls, and execution flow across a session. It reads the logs and OpenTelemetry traces your agents already emit, evaluates that activity to decide whether an agent is operating outside its intended boundaries, and flags behavioral anomalies, suspicious intent, and policy violations.

Some key features that make Agent Anomaly Detection practical to run in production:

• No added runtime latency: The analysis runs asynchronously and out of band from the live request path, so it does not slow your agents' responses.
• Clear, actionable findings: Every anomaly finding carries a severity, a plain-language explanation of what triggered it, and recommended next steps. Each anomaly finding is also published to your Security Command Center deployment, so your team can triage it alongside other findings.
• Grounded in the OWASP Agentic Top 10: Agent Anomaly Detection ships with detectors for a focused set of risks from the OWASP Top 10 for Agentic Applications (2026): tool misuse (ASI02), identity and privilege abuse (ASI03), cascading failures (ASI08), and rogue agents (ASI10), plus operational risks like resource exhaustion and token usage escalation. Its findings map to these recognized industry categories rather than a bespoke set of rules.
• Custom business logic in anomaly detections coming soon: We are actively working on the ability for users to define what anomalies mean in the context of their business. This will enable users to write flexible anomaly detectors in natural language together with deterministic rules, which flag when agents operate beyond enterprise-specific business guidelines. In addition, users will be able to validate the accuracy of their new custom business logic on past traffic.

Inside the detection pipeline

Agent Anomaly Detection balances detection speed, cost, and coverage. To strike that balance, it analyzes traces and logs in layers: a lightweight first pass scans all traffic to surface statistical anomalies and flag those sessions for further analysis. Then, an LLM-based reasoning layer deeply examines the flagged sessions.

To make that concrete, take the example of an Inventory Agent with a list_inventory tool. A user says, "I want to see your inventory. List 100 items at a time" and the agent starts paging through in large batches, jumping across offsets to pull the whole catalog.

Nothing here throws an error. The agent is only doing things it’s capable of, and there may be no policy preventing it. But Agent Anomaly Detection flags the anomalous behavior, working through the session in layers: the first layer flags the session as a statistical outlier from the volume and the repeated calls. The second layer reasons through the full exchange, recognizes the large-batch, offset-jumping pattern as systematic scraping rather than normal browsing, and returns a verdict with a plain-language explanation. Where a case needs a closer look, a third layer reconstructs the individual tool calls and their offsets to show exactly what was pulled.

The result is an anomaly finding: Resource exhaustion, Critical severity, at 95% probability, with a rationale and recommended fixes: rate-limit or block the list_inventory tool for that user, add authorization checks to restrict bulk inventory access, and alert on large-offset pagination patterns. The finding also surfaces in the Security Command Center for triage.

Beyond review, you can act on findings programmatically. Agent Anomaly Detection exposes an API to pull the anomalies for a given session, so an ADK callback or plugin can check a finding's severity and probability and block subsequent tool calls or halt the next turn when it crosses a threshold you set.

As agents take on more real work, more of the risk moves into their behavior. Agent Anomaly Detection monitors your agents’ behavior and flags anomalies for you to review and act on, without slowing your agents down.

Agent Anomaly Detection is currently in Private Preview for teams deploying agents on the Gemini Enterprise Agent Platform with ADK 1.2 or later. To get started, review the documentation for the prerequisites and setup. Once the prerequisites are met, you can turn on Agent Anomaly Detection with one-click provisioning.