Google’s November 12 study of Agent Anomaly Detection reports results from five public, non-Google benchmarks. The service was announced in September and remains in Private Preview. It reviews agent traces asynchronously, flagging suspicious sessions for investigation.
Google says it flagged 87% of harmful instructions that agents carried out. This measures post-execution detection. Benign sessions triggered alerts at rates of 2% to 16%, depending on the benchmark and tools.
Poisoned memory exposed a weakness: the detector caught four of 18 successful attacks involving instructions planted in long-term memory. Developers should account for that gap when handling stored context.
The evaluation used Gemini 2.5 Flash in simulated applications. External benchmarks give readers a comparison point, while the testing remains Google’s own assessment. Production workloads may behave differently. The service does not block actions. Controls that restrict tools and require approval before consequential actions still need their own place in an agent’s design.
Illustration: Google.
