Agent Anomaly Detection, now in Private Preview

Agent Anomaly Detection is a reasoning-based oversight and audit layer for autonomous agents deployed on the Gemini Enterprise Agent Platform. It examines what an agent actually does — its reasoning traces, tool calls, and execution flow across a session. It reads the logs and OpenTelemetry traces your agents already emit, evaluates that activity to decide whether an agent is operating outside its intended boundaries, and flags behavioral anomalies, suspicious intent, and policy violations.

Why it's practical to run in production

• No added runtime latency — the analysis runs asynchronously and out of band from the live request path, so it does not slow your agents' responses.
• Clear, actionable findings — every anomaly carries a severity, a plain-language explanation of what triggered it, and recommended next steps. Each finding is also published to your Security Command Center deployment, so your team triages it alongside other findings.
• Grounded in the OWASP Agentic Top 10 — it ships with detectors for a focused set of risks from the OWASP Top 10 for Agentic Applications (2026): tool misuse (ASI02), identity and privilege abuse (ASI03), cascading failures (ASI08), and rogue agents (ASI10), plus operational risks like resource exhaustion and token usage escalation. Findings map to recognized industry categories rather than a bespoke rule set.
• Custom business logic, coming soon — the ability to define what anomalies mean for your business, writing flexible anomaly detectors in natural language together with deterministic rules, and validating new custom business logic against past traffic.

Bottom line

The anomaly-detection-without-latency design is the feature that makes it viable: oversight runs continuously on data the platform already has, without taxing the request path. Combined with OWASP Agentic Top 10 grounding and Security Command Center integration, it's the "audit trail for agent behavior" piece that most agent stacks are still missing.