LoFP / a legitimate spike in agent usage, such as a batch job, a load test, a launch, or a retry storm, can produce a high volume of tool-requesting responses. confirm with the agent owner.

Techniques

Sample rules

AWS Bedrock High Tool-Request Call Volume

• source: elastic
• technicques:

Description

A machine learning job has detected an unusually high number of tool-requesting Amazon Bedrock model responses within 15 minutes for a caller, compared with that caller’s own history. High call volume can indicate repeated over-invocation or loop amplification by an AI agent (OWASP ASI02, Tool Misuse and Exploitation) and can lead to resource exhaustion and cost. The volume counts responses that requested tools, not confirmed tool executions.

Detection logic