Threat Pulse · Deep dive
Burst-rate anomaly
A sudden burst of tool calls far beyond normal cadence, typical of injection-driven loops or compromised credentials being exercised.
How we stop it
Burst detection triggers within seconds. The agent is throttled while the burst is assessed, then blocked if it does not resolve.
Frequently asked
What is burst-rate anomaly?
A sudden burst of tool calls far beyond normal cadence, typical of injection-driven loops or compromised credentials being exercised.
How does Rogue-Agent Defense stop burst-rate anomaly?
Burst detection triggers within seconds. The agent is throttled while the burst is assessed, then blocked if it does not resolve.
What should I do if I see burst-rate anomaly in the Threat Pulse feed?
Nothing urgent: the feed only shows attacks that were already blocked or flagged. If one class keeps appearing, review the linked defense guide and check your agents' allowlists, data boundaries, and spend caps.
Counts are real enforcement rows, anonymized. Attack classes seen in fewer than three workspaces never get a page.