Google has opened a private preview of Agent Anomaly Detection, a new audit layer for the Gemini Enterprise Agent Platform that reviews an agent’s reasoning traces and tool calls after a session ends, looking for behavior that a clean transcript would otherwise hide. Google developer relations engineer Achuth Narayan Rajagopal announced the feature on the Google Developers Blog on Tuesday.
The problem it targets is specific: an agent can complete a task, close the ticket, and pass every standard metric while still having grabbed a tool it had no business touching or expanded its own access mid-session. Nothing throws an error in that scenario, so nothing gets flagged under conventional evaluation. Agent Anomaly Detection is built to catch exactly that gap by reading the OpenTelemetry logs agents already produce and scoring the session for suspicious intent after the fact.
Google structured the system in tiers to keep cost down. Every session gets screened by a cheap statistical filter that looks for outliers, an unusual volume of repeated calls being the clearest example, before anything moves further. Only the sessions that filter flags reach a second, LLM-based reasoning layer built to read the full exchange for intent. A third layer, reserved for sessions that need closer inspection, reconstructs the individual tool calls to show exactly what an agent pulled and when.
Google’s own walkthrough illustrates the design with an inventory agent that starts paging through a catalog in large batches after a user asks to “see your inventory.” The first tier flags the volume as an outlier. The second tier recognizes the offset-jumping pattern as scraping rather than ordinary browsing. The system returns a finding: resource exhaustion, critical severity, 95% probability, alongside recommended fixes such as rate-limiting the tool and adding authorization checks. That finding also lands in Google’s Security Command Center, where a team can triage it next to other alerts.
Google frames its detectors against the OWASP Top 10 for Agentic Applications (2026), a published risk taxonomy that covers tool misuse, privilege abuse, cascading failures, and rogue-agent behavior, rather than a proprietary rule set the company built on its own. That is a deliberate credibility move: a customer evaluating the feature can check its coverage against an external standard instead of taking Google’s word for what counts as anomalous. Google also says it is building support for custom, natural-language business rules on top of the built-in detectors, though that capability is not yet shipping.
The launch arrives as agentic deployments move from pilots into systems that issue refunds, edit records, and call internal tools without a human approving each step. Anthropic, OpenAI, and Microsoft have all shipped their own guardrail and oversight tooling for agents this year, and an audit layer that runs asynchronously, without adding latency to the live request, is becoming table stakes rather than a differentiator. Google says the analysis runs out of band from the request path, and it exposes an API so an ADK callback can block a tool call automatically once a finding crosses a severity threshold the operator sets.
Access is limited for now: Agent Anomaly Detection requires ADK 1.2 or later and is available only to teams already deploying on the Gemini Enterprise Agent Platform. Teams running production agents on a rival stack should ask their vendor whether an equivalent out-of-band audit layer exists, since Google’s one-click provisioning sets a concrete bar for what “monitored autonomy” now means in enterprise contracts.
Google Developers Blog, September 16, 2026.
