Gemini Agent Anomaly Detection: Private Preview Is Live

Google shipped Agent Anomaly Detection for the Gemini Enterprise Agent Platform last week, and it fills a gap that has been embarrassingly obvious since agents started touching production systems: you couldn’t actually watch what an agent was doing while it was doing it. The feature landed in private preview on September 11. It’s the first platform-native monitoring layer grounded in the OWASP Top 10 for Agentic Applications. If you’re building agents on Google Cloud and wondering why your security story still feels like an afterthought, this is the thing to apply for.

What It Is, and Why It’s Different

Agent Anomaly Detection is not a static code scanner. It’s not a network perimeter guard. It’s a behavioral analysis layer that reads the OpenTelemetry traces and logs your agents already emit and evaluates what they actually did — the reasoning, the tool calls, the session flow — not just what traffic crossed a wire.

The detection pipeline has three layers. A lightweight statistical pass flags outlier sessions without slowing anything down. A second layer brings an LLM-as-a-judge to evaluate flagged sessions for suspicious intent or policy violations. A third layer reconstructs individual tool calls when deeper inspection is needed. Critically, all of this runs asynchronously and out of band from the live request path. Your agents don’t wait. No latency added.

What Gemini Agent Anomaly Detection Catches

The feature ships with detectors for four categories from the OWASP Top 10 for Agentic Applications 2026 — the four that hurt most in production:

• ASI02 — Tool misuse: The agent calls a tool outside its intended scope, or with inputs crafted to exploit the tool. Classic prompt injection via tool parameters.
• ASI03 — Identity and privilege abuse: The agent acquires credentials or permissions beyond what its task requires. The blast radius problem.
• ASI08 — Cascading failures: Multi-agent chains that spiral. One agent’s bad output becomes another agent’s instruction. This is how minor bugs become incidents.
• ASI10 — Rogue agents: Compromised, misaligned, or drifting agents operating in ways that no longer match their intended behavior. Hard to catch without behavioral baselines.

On top of those, it monitors for resource exhaustion and token usage escalation — the quiet disasters that show up as unexpected bills before anyone notices something is wrong.

How to Enable It

Requirements: Gemini Enterprise Agent Platform with ADK 1.2 or later. Once prerequisites are met, provisioning is one-click. It reads the OpenTelemetry traces your agents already emit, so if you have observability set up, you’re most of the way there.

Findings surface in Security Command Center for manual triage. The integration that matters for production is the API and the ADK callback pattern, which turns detection into automated enforcement:

async def on_after_tool_call(session_id: str, result: ToolCallResult) -> None:
    anomalies = await geap_client.get_anomalies(session_id)
    for anomaly in anomalies:
        if anomaly.severity == "HIGH" and anomaly.probability > 0.85:
            raise ToolCallBlockedError(f"Blocked: {anomaly.category}")

Detect, then block the next tool call or halt the agent turn entirely. Human-in-the-loop is optional, not required. The full setup guide is in the GEAP anomaly detection documentation.

Where It Fits Against Falcon Guardian and AIR Security

The AI agent security market has split into three distinct layers, and this framing is actually useful for deciding what to deploy:

• Pre-call (AIR Security): Screens instructions, tools, and data before the agent acts. An inline firewall at the context boundary.
• Platform behavioral (GEAP Anomaly Detection): Watches what agents do after the call — reasoning traces, tool chains, session behavior over time.
• Endpoint runtime (CrowdStrike Falcon Guardian): Traces agent actions down to OS-level processes on managed endpoints.

These aren’t competing. A team running agents through GEAP gets platform-behavioral coverage for their cloud workloads. If those agents also run local toolchains on managed endpoints, Falcon Guardian covers the process level. If you’re worried about malicious instructions entering from external sources, AIR Security sits in front of all of it. Stack based on where your attack surface is, not on vendor positioning.

What’s Coming

The current feature set is useful. The roadmap item is the real unlock: custom anomaly detectors written in natural language plus deterministic rules. Google’s example — ‘flag any session where the agent attempts a refund above $500 without supervisor approval’ — signals this is being built for SOC analysts, not just platform engineers. When that ships, a security team won’t need a developer to add a new detection policy.

Agent Anomaly Detection is in private preview now. Check the Google Developers Blog announcement for how to apply, verify you’re on ADK 1.2 or later, and review what Security Command Center findings will look like before you deploy.