Google Agent Anomaly Detection flags 87% of executed agent goal hijacks in independent benchmarks

• Agent Anomaly Detection flagged 87% of harmful instructions that agents actually executed across five public benchmarks, including AgentDojo, InjecAgent, Agent Security Bench, AgentDyn, and AgentHarm.
• The underlying model (gemini-2.5-flash) resisted or failed to execute about half of the harmful instructions, refusing 75% of direct requests and ignoring or failing at roughly 30% of instructions hidden in tool output.
• False positives occurred in 2% to 4% of benign office tasks but rose to 16% on AgentHarm, where benign tasks involved high-impact actions like social media posting and terminal commands.
• The tool's weakest area was poisoned memory, where it caught only 4 of 18 sessions where instructions planted in long-term memory caused the agent to act.

Test Methodology

• Tests used agents built with the Agent Development Kit (ADK) running gemini-2.5-flash on simulated apps.
• Each agent completed at least 300 benign sessions to establish a behavioral baseline before testing.
• Benchmark checks used deterministic code to label sessions based on final app states, preventing the agent from misleading the grader.

Performance Breakdown

• Flag rates for executed harmful instructions were 85% on AgentDojo, 87% on InjecAgent, 99% on AgentDyn, and 81% on AgentHarm.
• In 8 of 11 apps, the tool flagged at least 95% of executed harmful instructions; the lowest rate was 63% in AgentDojo's Slack app.
• The tool flagged 55% of refused direct requests in AgentHarm but only 11% to 25% of resisted instructions hidden in tool output.

Limitations and Recommendations

• New agents require history for accurate detection; on AgentDyn, detection rose from 33% with 220 benign sessions to 99% with 360 sessions.
• The tool does not block actions but reports anomalies to Security Command Center; users should route Critical and High findings to incident teams.
• Google recommends defense in depth, including screening untrusted content with Model Armor and using Semantic Governance Policy to block risky tool calls before execution.