# Google tests Agent Anomaly Detection on five outside agent-security benchmarks

published: 2026-11-13T00:05:32.350Z
topic: infrastructure
source: https://developers.googleblog.com/how-agent-anomaly-detection-scores-on-benchmarks-we-didnt-write/
url: https://aiagentnews.io/stories/google-tests-agent-anomaly-detection-on-five-outside-agent-security-benchmarks

Google ran its Agent Anomaly Detection feature, now in Private Preview, against five public agent-security benchmarks it did not write. The tool flagged 87% of harmful instructions that agents carried out, but it caught only 4 of 18 cases of poisoned long-term memory.

The tests covered AgentDojo, InjecAgent, Agent Security Bench, AgentDyn and AgentHarm, 1,774 sessions in all. Each agent was built with the Agent Development Kit and ran gemini-2.5-flash against the benchmarks' simulated apps. A deterministic Python check read the final app state to label each session, so the grader could not be misled by injected text.

The underlying model did not follow about half of the harmful instructions it read, and it refused about three in four direct requests for harm. Agent Anomaly Detection flagged 85% to 99% of carried-out instructions on four benchmarks, but flagged only 1 of 141 sessions where the agent never read the instruction. False alarms ranged from 2% to 16% of benign sessions, with higher rates for agents that use high-impact tools.

The tool reads traces and logs asynchronously and does not block actions. Google says its weak spots include resisted attempts, single small actions such as one page visit, and new agents that lack a few hundred sessions of history.

## Why it matters if you build agents

If you build agents that read email, web pages or files, the study suggests that detection after the fact will miss much of what gets through, especially injected instructions stored in memory. Pair it with controls that run before tool calls, such as prompt-injection screening, tool-call policies and human approval for payments or outbound messages. Expect more false alarms if your agent uses high-impact tools, and plan triage by severity.