Google’s Agent Anomaly Detection caught 87% of the harmful instructions that agents actually executed across five public security benchmarks, according to a Google Developers Blog post dated November 12, 2026. The same test exposed a hole: when the poison sat in an agent’s long-term memory, the tool caught only 4 of 18 cases. Google ran benchmarks it did not write, which is the right move for a security vendor grading its own product.
The tool is in Private Preview on Gemini Enterprise Agent Platform. Google announced it in September. It reads an agent’s traces and logs after the fact, adds no latency, and marks sessions where the agent steps outside its intended boundaries. It reports anomalies and does not block anything.
The five benchmarks are AgentDojo, InjecAgent, Agent Security Bench, AgentDyn and AgentHarm. In four, the harmful instruction hides inside data returned by a tool, the pattern OWASP calls agent goal hijack and ranks first in its Top 10 for Agentic Applications (2026). In AgentHarm, the harmful request comes straight from the user. Google scored 1,774 sessions in total, using an agent built on its Agent Development Kit with gemini-2.5-flash, running on simulated apps.
The model did part of the defending. Faced with outright harmful asks, it declined 75% of them; for instructions buried in tool output, it ignored or botched about 30%. Executed attacks were what remained, and those drew the 87% flag rate. By benchmark, the rate was 85% on AgentDojo, 87% on InjecAgent, 99% on AgentDyn and 81% on AgentHarm. In 8 of 11 apps it reached at least 95%. The weakest was AgentDojo’s Slack app at 63%, where many attacks request a single minor step, like opening a web page, that resembles ordinary browsing.
Scoring was done by deterministic Python checks on the final state of the simulated apps, for example whether funds left an account. A model did not grade the sessions, so an injected instruction could not talk its way past the grader.
False alarms ran from 2% to 16% of benign sessions, and the spread tracks the toolset. Across the three injection benchmarks, where harmless sessions are office chores, the rate stayed at 2% to 4%. On AgentHarm it hit 16%, because the harmless tasks mirror the harmful ones: posting to social media, running terminal commands, downloading files. Google’s own wording is that normal use of high-impact tools looks more like misuse.
Two other weak spots matter for rollout. Some detection methods need history, since the tool learns each agent’s habits. On AgentDyn it flagged 33% of executed attacks when each agent had about 220 benign sessions behind it, and 99% at 360. The main test gave each agent a baseline of 300 or more benign sessions first. And the tool flagged only 11% to 25% of instructions the agent read and resisted.
The limits are Google’s to name, and it names them. The study used one agent model and simulated apps, and Google suspects its harmless tasks are simpler than real production traffic. The tool returned no result for about 6% of sessions; counting those as misses cuts the overall rates by 1 to 2 points. Google also found no public benchmarks with labeled traces covering cascading failures, identity abuse or privilege abuse, so those categories remain untested.
Google’s recommendation is layered defense: filter untrusted content with Model Armor, check proposed tool calls with Semantic Governance Policy (in Preview), require human approval for payments and outbound email, limit each agent’s tools, and send complete telemetry. The detector sits at the end of that chain.
Any team with agents that hold long-term memory should treat this tool as blind to that attack path for now, and put write controls on the memory store itself. Teams whose agents live on high-impact tools should budget triage time for the first weeks of findings.
Google Developers Blog, “How Agent Anomaly Detection scores on benchmarks we didn’t write,” published November 12, 2026.
