Gemini Enterprise Agent Platform 推出 Agent Anomaly Detection 私密预览

每一代新模型都让 AI Agent 更强大、更自主，运行成本也更低。团队正在让它们处理真实业务任务：发放退款、更新记录、代表用户调用内部工具。但模型能力更强，并不自动意味着更安全。Agent 在运行时做出的决策越多，其风险就越会从代码本身转移到行为上。

真正的损害往往发生在表面看似无害的会话中：Agent 返回了干净的答复并关闭工单，直到事后你才发现，它调用了本不该触碰的工具，或者执行了一项悄然扩大其自身访问权限的请求。由于没有任何事情明显失败，该会话通常会通过常规的指标型评估，而不会得到第二次审查。

Agent Anomaly Detection 正是为弥合这一缺口而构建。它现已在 Gemini Enterprise Agent Platform 上进入私密预览（Private Preview）。

什么是 Agent Anomaly Detection？

Agent Anomaly Detection 是面向部署在 Gemini Enterprise Agent Platform 上的自主 Agent 的、基于推理的监督与审计层。它通过跨会话的推理追踪、工具调用和执行流程，检查 Agent 实际执行了什么操作。它会读取你的 Agent 已经输出的日志和 OpenTelemetry 追踪，评估这些活动，以判断 Agent 是否在预期边界之外运行，并标记行为异常、可疑意图和策略违规。

以下是使 Agent Anomaly Detection 能够在生产环境中实际运行的一些关键特性：

• 不增加运行时延迟： 分析以异步方式运行，并位于实时请求路径之外，因此不会拖慢 Agent 的响应速度。
• 清晰、可操作的发现结果： 每项异常发现都附带严重程度、触发原因的自然语言说明以及建议的后续措施。每项异常发现还会发布到你的 Security Command Center 部署中，以便团队与其他发现结果一同进行分诊处理。
• 基于 OWASP Agentic Top 10： Agent Anomaly Detection 内置针对 OWASP Top 10 for Agentic Applications (2026) 中一组重点风险的检测器：工具滥用（ASI02）、身份与权限滥用（ASI03）、级联故障（ASI08）和失控 Agent（ASI10）；此外还涵盖资源耗尽和 Token 使用量激增等运营风险。其发现结果映射到这些获得业界认可的类别，而非一套定制规则。
• 异常检测中的自定义业务逻辑即将推出： 我们正在积极开发一项能力，使用户能够根据自身业务语境定义何为异常。这将使用户能够结合自然语言和确定性规则，编写灵活的异常检测器，在 Agent 的运行超出企业特定业务准则时进行标记。此外，用户还将能够在历史流量上验证新增自定义业务逻辑的准确性。

检测流水线内部机制

Agent Anomaly Detection 在检测速度、成本和覆盖范围之间取得平衡。为实现这一平衡，它分层分析追踪和日志：轻量级的第一轮分析会扫描全部流量，以识别统计异常，并将这些会话标记为需要进一步分析；随后，基于 LLM 的推理层会深入检查被标记的会话。

具体来看，假设存在一个带有 list_inventory tool 的 Inventory Agent。一名用户说：“我想查看你们的库存。每次列出 100 件商品。”随后，Agent 开始以大批量方式分页，并跨越不同偏移量拉取整个商品目录。

这里没有任何操作抛出错误。Agent 只是在执行它有能力执行的操作，而且可能没有任何策略禁止它这样做。但 Agent Anomaly Detection 会标记这种异常行为，并分层分析该会话：第一层根据请求量和重复调用，将该会话标记为统计离群值；第二层会推理完整的交互过程，将大批量、跨偏移量跳转的模式识别为系统性抓取，而非正常浏览，并返回包含自然语言解释的结论。对于需要更仔细审查的案例，第三层会重建各个工具调用及其偏移量，准确展示被拉取的内容。

最终结果是一项异常发现：资源耗尽，严重程度为 Critical，概率为 95%，并附带原因说明和建议修复措施：对此用户的 list_inventory 工具实施速率限制或直接阻止其调用；增加授权检查以限制批量库存访问；并针对大偏移量分页模式发出告警。该发现也会在 Security Command Center 中显示，以供分诊处理。

除了人工审查外，你还可以通过编程方式对发现结果采取行动。Agent Anomaly Detection 提供 API，用于拉取指定会话的异常；因此，ADK 回调或插件可以检查某项发现的严重程度和概率，并在其超过你设定的阈值时，阻止后续工具调用或终止下一轮交互。

随着 Agent 承担越来越多的实际工作，更多风险将转移到其行为之中。Agent Anomaly Detection 会监控你的 Agent 行为，并标记异常供你审查和处置，同时不会拖慢 Agent 的运行速度。

开始使用

Agent Anomaly Detection 目前处于私密预览阶段，面向使用 ADK 1.2 或更高版本、在 Gemini Enterprise Agent Platform 上部署 Agent 的团队开放。要开始使用，请查看文档，了解前置条件和设置流程。满足前置条件后，你可以通过一键配置启用 Agent Anomaly Detection。

Each new model generation makes AI agents more capable, more autonomous, and cheaper to run. Teams are putting them to work on real business tasks: issuing refunds, updating records, calling internal tools on a user's behalf. But a more capable model is not automatically a safer one. The more decisions an agent makes at runtime, the more its risk shifts from its code to its behavior. The real damage often happens in sessions that look benign on the surface: the agent returns a clean answer and closes the ticket, and only afterward do you notice it reached for a tool it should never have touched, or acted on a request that quietly widened its own access. Because nothing failed outright, the session clears the usual metrics-based evaluations without any second look.

That gap is exactly what Agent Anomaly Detection is built to close. It's now in Private Preview on the Gemini Enterprise Agent Platform.

What is Agent Anomaly Detection?

Agent Anomaly Detection is a reasoning-based oversight and audit layer for autonomous agents deployed on the Gemini Enterprise Agent Platform. It examines what an agent actually does using its reasoning traces, tool calls, and execution flow across a session. It reads the logs and OpenTelemetry traces your agents already emit, evaluates that activity to decide whether an agent is operating outside its intended boundaries, and flags behavioral anomalies, suspicious intent, and policy violations.

Some key features that make Agent Anomaly Detection practical to run in production:

• No added runtime latency: The analysis runs asynchronously and out of band from the live request path, so it does not slow your agents' responses.
• Clear, actionable findings: Every anomaly finding carries a severity, a plain-language explanation of what triggered it, and recommended next steps. Each anomaly finding is also published to your Security Command Center deployment, so your team can triage it alongside other findings.
• Grounded in the OWASP Agentic Top 10: Agent Anomaly Detection ships with detectors for a focused set of risks from the OWASP Top 10 for Agentic Applications (2026): tool misuse (ASI02), identity and privilege abuse (ASI03), cascading failures (ASI08), and rogue agents (ASI10), plus operational risks like resource exhaustion and token usage escalation. Its findings map to these recognized industry categories rather than a bespoke set of rules.
• Custom business logic in anomaly detections coming soon: We are actively working on the ability for users to define what anomalies mean in the context of their business. This will enable users to write flexible anomaly detectors in natural language together with deterministic rules, which flag when agents operate beyond enterprise-specific business guidelines. In addition, users will be able to validate the accuracy of their new custom business logic on past traffic.

Inside the detection pipeline

Agent Anomaly Detection balances detection speed, cost, and coverage. To strike that balance, it analyzes traces and logs in layers: a lightweight first pass scans all traffic to surface statistical anomalies and flag those sessions for further analysis. Then, an LLM-based reasoning layer deeply examines the flagged sessions.

To make that concrete, take the example of an Inventory Agent with a list_inventory tool. A user says, "I want to see your inventory. List 100 items at a time" and the agent starts paging through in large batches, jumping across offsets to pull the whole catalog.

Nothing here throws an error. The agent is only doing things it’s capable of, and there may be no policy preventing it. But Agent Anomaly Detection flags the anomalous behavior, working through the session in layers: the first layer flags the session as a statistical outlier from the volume and the repeated calls. The second layer reasons through the full exchange, recognizes the large-batch, offset-jumping pattern as systematic scraping rather than normal browsing, and returns a verdict with a plain-language explanation. Where a case needs a closer look, a third layer reconstructs the individual tool calls and their offsets to show exactly what was pulled.

The result is an anomaly finding: Resource exhaustion , Critical severity, at 95% probability, with a rationale and recommended fixes: rate-limit or block the list_inventory tool for that user, add authorization checks to restrict bulk inventory access, and alert on large-offset pagination patterns. The finding also surfaces in the Security Command Center for triage.

Beyond review, you can act on findings programmatically. Agent Anomaly Detection exposes an API to pull the anomalies for a given session, so an ADK callback or plugin can check a finding's severity and probability and block subsequent tool calls or halt the next turn when it crosses a threshold you set.

As agents take on more real work, more of the risk moves into their behavior. Agent Anomaly Detection monitors your agents’ behavior and flags anomalies for you to review and act on, without slowing your agents down.

Get started

Agent Anomaly Detection is currently in Private Preview for teams deploying agents on the Gemini Enterprise Agent Platform with ADK 1.2 or later. To get started, review the documentation for the prerequisites and setup. Once the prerequisites are met, you can turn on Agent Anomaly Detection with one-click provisioning.