Monitor what the agent is actually doing — not just what it returns — and compare it against what it should be doing. Log every tool call, every external fetch, every action taken. Alert on anomalies: an agent whose stated task is "summarize emails" should not be making outbound HTTP requests to unknown domains, reading the file system, or accessing systems outside its defined scope.

Implement goal drift detection: periodically verify that the agent's current reasoning is consistent with its original task. A sudden pivot — from document summarization to payment routing — is a red flag regardless of how it occurred.

Define a behavioral baseline for each agent: expected tool calls, expected data sources accessed, expected output formats. Build alerting around deviations. For high-stakes agents, implement a secondary monitoring agent that observes the primary agent's actions and flags anomalies for human review. Treat an agent that accesses an unexpected resource the same way you'd treat an employee accessing a system they've never used before — investigate it.

Behavioral monitoring catches hijacks after they begin — not before. It also struggles with Scenario 09 (gradual drift), where no single action is anomalous. Fast-moving agents can cause significant damage in the time between detection and response. Monitoring must be paired with circuit breakers (MIT 07) that can halt execution automatically.