An anomaly detector learns or defines a baseline for normal behavior, then scores new events according to how unusual they are. In AI workflows, it can monitor spending, tool use, output rates, errors or other operational signals.
An unusual event is not automatically harmful, and a harmful event may resemble normal activity. Thresholds, context and human review are needed to balance false alarms against missed incidents and to update the baseline as legitimate behavior changes.
ELI5
Anomaly detection finds events that look meaningfully different from the usual pattern. It does not automatically decide that the event is bad; it identifies something that may deserve a closer look.
For example, an AI service might normally make a few tool calls each minute and suddenly make hundreds. A detector can flag that change for investigation, but people need context because a legitimate large job can look unusual and harmful behavior can sometimes look normal.
