Google Launches Private Preview of Agent Anomaly Detection on Gemini Enterprise Agent Platform

Google has launched a private preview of the Agent Anomaly Detection feature on the Gemini Enterprise Agent Platform to detect abnormal behavior in autonomous agents. As the autonomy of AI agents increases, 'behavior'-based risks such as tool misuse and privilege escalation, which are difficult to catch with traditional metric-based evaluations, have emerged. To address this, a reasoning-based oversight and audit layer has been introduced.

How It Works and Key Features

This feature analyzes logs, OpenTelemetry traces, reasoning traces, tool calls, and execution flows generated by agents to determine whether they have deviated from intended boundaries. The analysis runs asynchronously, separate from the live request path, so there is no runtime latency. Detected anomalies are posted to the Security Command Center with severity, plain-text explanations, and recommended actions, allowing them to be triaged alongside other security findings.

Detection criteria are based on the OWASP Agentic Top 10 (2026). Specifically, it detects tool misuse (ASI02), identity and privilege abuse (ASI03), cascading failures (ASI08), rogue agents (ASI10), and operational risks such as resource exhaustion and token usage escalation. In the future, a Custom business logic feature that combines natural language and deterministic rules to detect violations of company-specific business guidelines is also planned to be added.

3-Stage Detection Pipeline

To balance speed, cost, and coverage, a hierarchical analysis structure has been adopted as follows:

• Stage 1 (Lightweight pass): Scans all traffic to discover statistical outliers and flags sessions.
• Stage 2 (LLM reasoning): Performs in-depth analysis of flagged sessions to understand intent.
• Stage 3 (Deep dive): If necessary, reconstructs individual tool calls and offsets for detailed verification. (The original text explicitly mentions only Stages 1 and 2, but the detailed verification process is mentioned in the example.)

For example, if an inventory management agent uses the list_inventory tool to scrape the entire catalog via large-scale pagination of 100 items at a time, it is flagged as an outlier in Stage 1 due to volume and repetitive calls, and in Stage 2, the LLM judges this as systematic scraping. As a result, a Critical severity and 95% probability are assigned for the risk of Resource exhaustion, and recommended actions such as rate-limiting or blocking the user's tool usage are presented.

Integration and Availability

Anomalies per session can be retrieved via the provided API. By checking severity and probability through an ADK callback or plugin, subsequent tool calls can be blocked or the next turn can be interrupted when set thresholds are exceeded. The Private Preview is currently underway for teams using ADK 1.2 or higher, and it can be enabled via one-click provisioning if the prerequisites are met.