AI agent security
Google Uses Three-Layer Trace Analysis to Audit Agent Behavior, but Anomaly Detection Happens After Tool Execution
Gemini Enterprise Agent Platform’s Agent Anomaly Detection asynchronously analyzes OpenTelemetry traces, tool parameters, and execution flows, then uses lightweight models and LLMs to identify anomalies. The private preview adds no latency to real-time requests, but the tradeoff is that it primarily provides post-event detection and requires storing raw telemetry containing prompt and response content.
Google has made Agent Anomaly Detection available in private preview, seeking to address agent behavior risks that traditional code scanning and network perimeter tools cannot see. The service reads OpenTelemetry logs generated by ADK and execution traces spanning an entire session, examining reasoning flows, tool calls, state, and parameter history instead of merely determining whether the final text response appears normal.
The pipeline has three layers. The first uses statistical methods and lightweight machine learning models to scan all traffic and identify anomalous sessions based on factors such as call volume, retries, or token consumption. In the second, an LLM evaluates the complete traces of the filtered sessions and produces threat assessments with natural-language explanations. The third allows investigators to trace individual tool executions and parameter changes. The default detectors cover tool misuse under OWASP Agentic Top 10 category ASI02, identity and privilege abuse under ASI03, cascading failures under ASI08, agents deviating from their roles under ASI10, and resource exhaustion. Results include severity and probability scores and are sent to Security Command Center. Applications can also query the results for a specific session through an API, allowing an ADK callback or plugin to stop tool calls in subsequent turns.
The claim of “no added latency” comes from out-of-band asynchronous analysis, not from eliminating the cost of detection. If an agent has already transferred funds, deleted data, or exfiltrated content during the current turn, a finding generated later cannot undo the initial action. Genuine real-time blocking still requires a combination of least privilege, tool-level authorization, rate limits, and synchronous policies. Google has also not disclosed false-positive rates, false-negative rates, analysis latency, or per-session costs, and the 95% probability shown in the demonstration should not be treated as evidence of general calibration.
Deployment constraints are equally important. The service currently accepts only agents built with Python ADK 1.2 or later on Gemini Enterprise Agent Runtime, with version 2.1.0 or later officially recommended. Logs and the Observability bucket must be located in the same U.S. multi-region, and tracing, Log Analytics, and raw metadata containing prompt inputs and response outputs must be enabled. This means security teams must address data residency, sensitive prompts, retention periods, and read permissions before enabling the service. Areas to watch next include custom business rules, validation through offline replay, and detection benchmarks that enable third-party comparisons.