The report
Snowflake describes Dangerous Agent Activity Detection as multi-stage screening plus contextual analysis of delegated authority. Its reported monitoring figures are internal and do not give independent false-negative measurements. An alert rate is not the rate of successful attacks, and detection is not a pre-execution permission check.
The reported monitor flags actions against actual shared-workspace authority. That enforcement concern is also measured, under different controlled conditions, in the agent harness approval study. Neither report establishes a universal detection or prevention rate.
A contextual detector may recognize a suspicious request, but an alert alone is not an authority decision. The product’s reported evaluation does not demonstrate that every mutating agent action is intercepted before commit, or that later corrections can reverse a completed external effect.
Detection needs an effect boundary
The described contextual monitor is meant to distinguish an authorized red-team action from suspicious workspace behavior, rather than treating every powerful tool invocation as hostile. That is a meaningful evaluation target, but the article's internal cases do not supply a measured false-negative rate across unseen attacks. The stated unsafe process-termination detection also does not show that the system blocked the effect before execution or reversed it afterward.
A useful independent test would preserve the original user's task and permitted authority, then measure three outputs separately: risky calls that were flagged, unauthorized actions actually committed, and valid work incorrectly interrupted. The auto-approval benchmark measures related execution-policy behavior under a different harness; its attack rate cannot be used as Snowflake's detection benchmark.