Key points
- Agent Anomaly Detection flagged 87% of executed harmful instructions across five public benchmarks
- The system detected only four of eighteen cases involving poisoned long-term memory
- False alarms occurred in 2% to 16% of benign sessions depending on tool usage
Google reported performance figures for its Agent Anomaly Detection feature using five security benchmarks it did not author.reported The tests measured how well the system identifies when AI agents follow harmful instructions hidden in data or user requests.The tests show the system works best when harmful instructions appear in immediate data rather than long-term memory.The benchmark results indicate strong post-execution detection for tool-output injections but weak coverage for memory-poisoning vectors.
Evidence: reported
How Agent Anomaly Detection scores on benchmarks we didn't writeaifleet-google-dev
The evidence
According to a Google Developers blog post, the feature caught 87% of harmful instructions that agents actually executed.reported The tests used the Agent Development Kit with the gemini-2.5-flash model on simulated applications.reported Each agent ran at least 300 benign sessions first so the detection system could learn normal behaviour patterns.reported
Evidence: reported
How Agent Anomaly Detection scores on benchmarks we didn't writeaifleet-google-dev
Evidence: reported
How Agent Anomaly Detection scores on benchmarks we didn't writeaifleet-google-dev
Evidence: reported
How Agent Anomaly Detection scores on benchmarks we didn't writeaifleet-google-dev
The model itself refused three out of four direct requests for harm from users. It also ignored or failed to act on about 30% of instructions hidden within tool outputs.reported Deterministic code determined the final labels for each session, preventing the model from influencing the grading process.
Evidence: reported
How Agent Anomaly Detection scores on benchmarks we didn't writeaifleet-google-dev
The decision
The blog post states that Agent Anomaly Detection operates asynchronously by reading traces and logs. This design adds no runtime latency to the agent’s actions. Developers can combine this monitoring with semantic governance and strict tool limits as part of a broader security strategy.
What to make of it
The system shows significant gaps when handling instructions planted in an agent’s long-term memory. It flagged only four of the eighteen sessions where poisoned memory caused the agent to act. False alarms ranged from 2% to 16% of benign sessions, varying by the specific tools the agent used.reported
Evidence: reported
How Agent Anomaly Detection scores on benchmarks we didn't writeaifleet-google-dev
In practice
Startup founders building agentic applications need to understand these documented limitations before relying on this feature for security. The feature was announced in Private Preview in September on the Gemini Enterprise Agent Platform. Users must integrate it alongside other controls because it does not prevent all harmful actions.
Why it matters
- Founders can verify that the detection system works against external benchmarks rather than only internal tests
- The false-alarm rate varies between 2% and 16% depending on the specific tools the agent uses
- The system detected only four of eighteen cases involving poisoned long-term memory, identifying a clear gap
- Asynchronous monitoring allows teams to add security layers without adding runtime latency to agent performance
Topics: AI security, agent governance, Google Cloud, OpenTelemetry, benchmarking
Updated
Then / now / next
Security tools often performed well only on tests written by their own development teams.
Google published results from five non-Google-written public benchmarks to demonstrate independent validation.
The source does not specify future release plans or changes to the feature's availability status.
Story timeline
- Then Security tools often performed well only on tests written by their own development teams.
- 12 Nov 2026 How Agent Anomaly Detection scores on benchmarks we didn't write
- Now Google published results from five non-Google-written public benchmarks to demonstrate independent validation.
- Next The source does not specify future release plans or changes to the feature's availability status.
The strongest doubt
Counterpoint from the sources
The system missed fourteen of eighteen cases where instructions were hidden in the agent's long-term memory, suggesting significant blind spots for persistent threats.
Models named here
Gemini 2.5 Flash
1,048,576 context tokens. Model and pricing reference (2026-11-01).
Model cards and cost
Numbers in context
Circle area is proportional to the magnitude; labels retain signs. Figures may describe different measures. Read their contexts above.Ask the article
Local keyword search of this article; no generated answers.Did this article give you the evidence you needed?
Your choice stays on this device. No public tally.Questions readers ask
Does Agent Anomaly Detection prevent agents from following harmful instructions?
No, it flags sessions for post-execution review after the agent has already acted, catching 87% of executed harmful instructions.
How does the system determine if a session is harmful?
Deterministic code reads the final state of simulated apps to label sessions, ensuring the model cannot cheat the benchmark grading.
Is this feature available to all developers immediately?
The feature was announced in September in Private Preview on the Gemini Enterprise Agent Platform, according to the blog post.
Connected stories
Reading receipt
- Agent Anomaly Detection flagged 87% of executed harmful instructions across five public benchmarks
- The system detected only four of eighteen cases involving poisoned long-term memory
- False alarms occurred in 2% to 16% of benign sessions depending on tool usage
Still open: How will the false-alarm rates change as agents use more complex or varied toolsets?
Still open: Will the detection rate for poisoned memory improve in future versions of the feature?