How Agent Anomaly Detection scores on benchmarks we didn't write

Google announced the release of Agent Anomaly Detection in private preview on the Gemini Enterprise Agent Platform, detailing its benchmark performance in Google Developers Blog's report. The security feature monitors artificial intelligence agents asynchronously by analyzing OpenTelemetry traces and execution logs without introducing runtime latency. Designed to counter agent goal hijacking—the top threat identified in the 2026 OWASP Top 10 for Agentic Applications—the system identifies unauthorized behaviors after tool calls ingest untrusted external text.

This technical report examines benchmark evaluations, detection thresholds, failure points, and architectural integration patterns for platform engineers and enterprise security architects deploying agentic workflows. It details how the monitoring system identified 87 percent of executed harmful instructions across five external security suites, while outlining false alarm distributions across everyday office tools and high-impact administrative functions.

01Deterministic checks across five public suites

Google evaluated the monitoring platform using agents constructed with its Agent Development Kit running the gemini-2.5-flash model against simulated application environments. To eliminate internal scoring bias, engineers evaluated performance against five public benchmark suites created by independent research teams: AgentDojo from NeurIPS 2024, InjecAgent from ACL 2024 Findings, Agent Security Bench from ICLR 2025, AgentDyn from 2026, and AgentHarm from ICLR 2025.

Across 1,774 evaluated sessions, deterministic Python validation code inspected the final environment state to determine whether actions like unauthorized fund transfers occurred. By relying on programmatic assertions rather than language models to label session outcomes, the evaluation verified that injected instructions could not deceive the automated grading apparatus. Each agent completed a baseline calibration phase of at least 300 benign runs to establish typical operational behavior.

Evaluation outcomes were divided into three operational categories based on model telemetry and environmental impact. Sessions were classified as never read when an agent avoided opening malicious emails or files, resisted when the agent encountered harmful text but declined execution, or carried out when the model fulfilled the adversarial payload. The evaluation concentrated on goal hijacking and tool misuse because current public benchmarks lack labeled trace corpora for cascading systemic failures or privilege abuse.

02Detection rates across applications and benchmarks

The underlying language model resisted approximately half of all received adversarial instructions on its own, denying 75 percent of direct harmful prompts and about 30 percent of indirect instructions embedded in tool outputs. For malicious instructions that bypassed model-level safeguards and were executed, Agent Anomaly Detection successfully flagged 87 percent for post-execution review. Across all malicious sessions, including unread and resisted items, detection rates ranged between 45 percent and 62 percent.

Detection performance remained consistent across four independent benchmark suites with outcome splits. The system flagged 85 percent of carried-out harmful instructions on AgentDojo, 87 percent on InjecAgent, 99 percent on AgentDyn, and 81 percent on AgentHarm. In the 141 evaluation instances where the agent never opened the specific file containing the attack payload, the system correctly generated only a single false notification.

Across eleven simulated environments, eight applications demonstrated detection rates of at least 95 percent for carried-out attacks. The lowest detection frequency occurred within AgentDojo's simulated Slack interface, which recorded a 63 percent detection rate. Google noted that attack instructions in chat environments frequently requested isolated actions, such as visiting an external web page, which mimic routine browsing activity.

03Refused requests and tool-dependent false alarms

The monitoring framework captured malicious activity even when the underlying agent refused to execute the attack. In the AgentHarm benchmark, where human users directly supplied malicious requests, the system flagged 55 percent of refused sessions because the adversarial intent was clearly exposed in user messages. Conversely, when agents resisted indirect prompt injections nested within tool outputs, detection rates dropped to between 11 percent and 25 percent.

False alarm distributions varied significantly based on the inherent privilege profile of the agent's assigned tools. When evaluating standard office automation tasks across three injection benchmarks, benign sessions triggered false alarms at a rate of only 2 percent to 4 percent. These baseline workloads included common data processing, messaging, and routine workspace coordination activities that closely matched typical daily business operations.

Conversely, benign runs on the AgentHarm suite produced a 16 percent false alarm frequency because normal operational tasks mirrored attack mechanics. These legitimate workflows routinely executed terminal commands, downloaded external binaries, and made outbound social media posts. Google observed that when legitimate agent tasks rely on high-impact administrative tools, normal actions closely resemble unauthorized tool misuse.

04Poisoned memory gaps and session history limits

The evaluation revealed notable performance constraints regarding memory poisoning and historical baseline depth. In tests using Agent Security Bench, which planted malicious instructions inside long-term retrieval memory, Agent Anomaly Detection caught only 4 of 18 instances where poisoned context altered agent execution. The result highlighted that long-term contextual corruption remains significantly harder to detect than immediate tool payload injections.

Detection efficacy also depended heavily on the volume of historical baseline telemetry available for behavioral profiling. In the AgentDyn benchmark, the detection rate for executed harmful instructions dropped to 33 percent when agents possessed approximately 220 benign calibration sessions, compared to 99 percent once history reached 360 sessions. Furthermore, subtle unauthorized actions, such as single exploratory visits to external web pages, regularly evaded anomaly thresholds.

Engineering teams at Google are updating the platform to address these architectural blind spots across production environments. Planned enhancements focus on logging resisted intrusion attempts at lower severity tiers, improving discrimination between routine and malicious use of high-impact tools, accelerating baseline calibration curves for newly deployed agents, and building specialized heuristics for long-term memory poisoning.

05Multi-layer defense and Security Command Center integration

Google advised development teams to employ Agent Anomaly Detection as an asynchronous auditing component within a layered defense-in-depth posture rather than an inline execution blocker. Because the system flags sessions asynchronously from OpenTelemetry data, it does not stop in-flight API requests. Developers should ingest full telemetry via the Agent Development Kit, including complete prompt contexts and model response content.

Pre-execution controls are required to prevent malicious actions before tools run. Teams should filter inbound prompts and tool returns with pre-execution scanners like Model Armor and implement Google's preview Semantic Governance Policy engine to validate proposed tool calls against organizational rules. High-impact operations, such as financial transactions, bulk data exfiltration pathways, and customer-facing email dispatch, should require mandatory human authorization while agents operate under minimal necessary tool scopes.

Operational findings export directly into Google Cloud Security Command Center, allowing enterprise security operations teams to triage critical and high-severity incidents. Reviewing team findings requires accounting for study limitations: benchmark trials relied exclusively on gemini-2.5-flash within synthetic environments, and approximately 6 percent of sent sessions returned null diagnostic results, which lowers overall baseline scoring by one to two percentage points.