Skip to main content

Anomaly Detection

Notices when an agent starts behaving unusually compared to its own normal pattern.

What It Does​

Anomaly Detection learns what "normal" looks like for each of your agents — how often they typically use each tool, and how long a session usually runs — and flags it when something suddenly deviates a lot from that pattern. It's like a bank noticing an unusual charge on your card: nothing about a single transaction is inherently wrong, it's just very unlike your usual spending.

The guard builds this baseline automatically from real usage over time; there's nothing to set up.

Why It Matters​

A sudden, large spike in how often an agent calls a particular tool — far more than it ever has before — can be an early sign that something has gone wrong: a compromised skill, a misbehaving automation stuck in a loop, or a subtler manipulation attempt that other guards didn't catch outright. Catching that early, even just as a heads-up, gives you a chance to look before it becomes a bigger problem.

What Gets Flagged​

  • A tool used far more than usual — many times more than its normal average for that agent
  • An unusually long session — significantly longer than the agent's typical session length
Scenario

An agent that normally sends a handful of emails a day suddenly sends dozens in a short session — well beyond anything in its history. Anomaly Detection notices the spike and logs a warning with the details (how many calls, how that compares to the baseline), so you can check whether it's a legitimate burst of activity or something worth investigating.

How It Responds​

This guard observes and alerts — it doesn't block anything on its own. When it flags something, the event is recorded in your audit log and, depending on your alert settings, you may also get a notification.

If You See an Anomaly Alert​

  1. Check the audit log entry for details — which tool, how many times, and how that compares to normal.
  2. Decide whether the activity is expected (a legitimately busy day) or worth investigating further.
  3. If it's expected and likely to recur, no action is needed — the guard will simply adjust its sense of "normal" as more usage accumulates.

Default Behavior​

Enabled by default. It takes a handful of sessions before the guard has enough history to judge what's normal for a given agent — you won't see alerts until then.