Red Flags in Agent Logs
Agent logs tell you what's about to happen before the bill does. These six patterns are the ones to automate detection for.
The six flags
1. Retry clusters — the same call repeating in tight bursts.
2. Tool-call storms — hundreds of tool calls in minutes.
3. Permission escalations — an agent reaching for more access.
4. New tool adoption — tools never seen before in the session.
5. Off-hours activity — calls at 2 AM.
6. Error-rate spikes — failures multiplying.
What to do
Watch for the flags, but enforce with rules: velocity limits stop retry clusters, allowlists stop new tools, time-of-day rules stop 2 AM.
At a glance
| Red flag | Rule |
|---|---|
| Retry clusters | Velocity limit |
| Tool-call storms | Daily ceiling |
| Permission escalations | Least-privilege + review |
| New tool adoption | Merchant allowlist |
| Off-hours activity | Time-of-day rule |
FAQ
Do I need log monitoring plus a firewall?
Monitoring tells you what's happening; the firewall stops the damage. Run both.
Which flag is most predictive?
Retry clusters — they precede most runaway incidents.
Related
Stop the next $12,400 night.
One API call (or MCP tool) in front of every agent transaction — APPROVED, BLOCKED, or FLAGGED, deterministic, ~5 ms, fully logged.
See plans — from $99/mo Try a live check