Agent Anomaly Detection reads the logs and OpenTelemetry traces that agents already emit, along with their reasoning traces, tool calls and execution flow across a session. It decides whether an agent is operating outside its intended boundaries and reports the findings with a severity, a plain-language explanation and recommended next steps. Each finding is also published to Security Command Center for triage alongside other findings.
The detectors cover a focused set of risks from the OWASP Top 10 for Agentic Applications (2026): tool misuse, identity and privilege abuse, cascading failures and rogue agents, plus resource exhaustion and token usage escalation. Analysis runs asynchronously, outside the live request path. Google says custom business-logic detectors, written in natural language and deterministic rules, are coming soon and can be checked against past traffic.
Access is currently limited to Private Preview for teams deploying agents with ADK 1.2 or later. Setup uses one-click provisioning once the documented prerequisites are met. Developers can also pull anomalies for a session through an API and have an ADK callback or plugin block tool calls or halt the next turn when a finding crosses a threshold they set.
Why it matters if you build agents
Teams running agents on this platform can review behavior that passes ordinary success metrics, such as a clean answer that hid an unexpected tool call or a widening of the agent's own access.
Because the API exposes severity and probability, developers can wire findings into ADK callbacks to block tool calls automatically, though they should set thresholds carefully and confirm the feature's availability while it remains in preview.
Get stories like this every weekday
One short email with the day's agent tooling news.