Google tool flagged 87% of bad agent steps in five tests

Google Cloud did a test of its Agent Anomaly Detection tool with five tests for agents that Google did not write. The tool reads the logs of an AI agent and flags steps that are not in its limits. Google tells that it flagged 87% of the dangerous instructions that the agent did, and gave incorrect alarms for 2% to 16% of safe sessions.

How it was tested

Google used an agent made with its Agent Development Kit, on the model gemini-2.5-flash, in test apps. Code, not a model, labeled each session. Each agent first did many safe sessions, because the tool learns the usual work of each agent.

The numbers

• 87% of the dangerous instructions that the agent did were flagged.
• 45% to 62% of all dangerous sessions were flagged.
• 2% to 16% of safe sessions gave incorrect alarms.
• 4 of 18 poisoned memory examples were found.

What is not known

The tool flags a small part of the bad steps from new agents until it has more than 300 safe sessions of history. Google found no tests for attacks that go from one agent to the next, or for incorrect use of identity and rights. It used one model only.

Insight: A detection rate depends on what the maker counts

Google counts the dangerous instructions that the agent did: 87%. For all dangerous sessions, the rate is 45% to 62%. A test of a rule monitor found about 70% of attacks, with 29.3% incorrect alarms. Tsinghua researchers hid side tasks from monitors in 59.94% of tests. A detection rate is only a number to compare, and the maker sets the items that it counts.