It checks for out-of-allowlist hosts, credentials the agent was not given, unapproved data transfers, retries after blocked calls, and instructions planted in content the agent read. It produces a ranked report with quoted evidence for human review.
The workflow can read Managed Agents sessions, Messages API logs, or Claude Agent SDK logs. In the cookbook's 20 example sessions, it flags four for action; all four are staged examples designed to exercise the review. Anthropic estimates that reviewing all 20 costs about $0.10 at list price using Claude Haiku 5.5. The source describes a review workflow, not independent evidence of detection performance on production traffic.