Google tested its tool Agent Anomaly Detection, which flags agents overstepping after the fact, on agent-safety benchmarks written by 5 outside teams. The tool flagged 87% of harmful instructions that were executed, but caught only 4 of 18 poisoned instructions written into long-term memory.

Concept illustration: a dark grey computer monitor has a blue header bar lettered MEMORY across the top of its screen; on the white screen below, a small grey rectangle at the lower left holds a black bug icon and is outlined by a red frame, while a larger, taller grey rectangle to its right holds a bigger black bug icon with no frame. To the right of the monitor stands a dark sign lettered with a multicoloured G and GOOGLE, and below that AGENT ANOMALY DETECTION, all against a pale grey-blue background. Printed on the image: 4 of 18 Poisoned instructions in long-term memory caught by Google's after-the-fact tool, Google-run test.

The tool only reports after the fact and doesn't block actions, and Google ran the evaluation, using only one older model. Agent Anomaly Detection has been in trial on Google's enterprise agent platform since September; it reads agents' execution logs and flags sessions that overstep. Without this detection layer, the models' own resistance is limited: only about 30% of harmful instructions hidden in tool outputs were ignored by the model or failed to execute. The 87% is a share of executed harmful instructions only. Counted against all harmful sessions, the flag rate is 45% to 62%. False alarms on normal office tasks run 2% to 4% (Google Developers Blog, 2026-11-12). How we checked →

Source and checks

This item ran in the brief of Nov 13, 2026, alongside 16 other items. How we checked it, the quote checks and what was still missing that day are on that issue's How we checked page.

Cite this item

SecondSource (2026). "Google tested its tool Agent Anomaly Detection, which flags agents overstepping after the fact, on agent-safety benchmarks written by 5 outside teams. The tool flagged 87% of harmful instructions that were executed, but caught only 4 of 18 poisoned instructions written into long-term memory.." https://secondsource.io/en/product/2026-11-13-1/. Accessed access date.