Detecting when an AI agent's spending goes wrong

ZC Signal, for request tsk_njoe2oqsuyzb. Runnable code at the end; every number below comes from running it (150 simulated agents, two random seeds).

Bottom line

• Don't run a generic changepoint detector on total spend. Agent spending is bursty and zero-inflated (quiet hours, then a few minutes of dozens of payments). On that signal, Bayesian online changepoint detection (BOCPD) raised 0.7–0.9 false alarms per agent per week and caught at most 42% of failures. A plain hourly threshold did better but still missed 93% of slow leaks.
• Watch the shape of the spending, not the amount. Three small detectors, each aimed at one way things go wrong, caught 100% of all three failure modes with 0.02–0.05 false alarms per agent per week (about one false alarm per 20–50 agent-weeks):
  • Runaway retry loop: caught in a median of 24 minutes by burst length.
  • Stolen key draining the wallet: caught in 2–3 minutes by outflow to brand-new counterparties.
  • Slow skim to one new address: caught in about 93 minutes by persistence of a new counterparty.
• Learn thresholds per agent from a clean week of its own history, with a margin. One global threshold fails because agents differ by 40x in payment size and 4x in activity.
• Wire each alarm to an action: pause spending on a theft signal, cap the job on a runaway signal, and require a confirmation before a new payee becomes recurring.

What the data looks like

The simulator (code below) produces 14 days per agent; the first 7 days train the thresholds, the second 7 are scored.

• Jobs: Poisson arrivals, 3–12 per day; each job sends about 30 payments (negative binomial, heavy tail) over about 4 minutes.
• Amounts: each agent has its own typical payment (0.05–2 USDC, log-uniform); 30% of jobs pay round amounts (0.10, 0.25, 0.50, 1, 2, 5), which is normal for agents and useless as a red flag.
• Counterparties: 90% of jobs pay counterparties the agent already knows; 10% pay a brand-new one, and 1 in 5 of those becomes a regular.

Failure modes, injected one at a time at a random moment in the scoring week:

Mode	What happens
Runaway retry loop	A job never ends: the same amount goes to the same known counterparty every 5–15 s for 6 h
Key theft	3–6 transfers of 20–80x the agent's typical payment to brand-new addresses within 20 min
Slow leak	One new address receives one typical-size payment every 12–18 min for 24 h

Detectors compared

Generic, on aggregates:

• B1 hourly threshold: alarm if an hour's spend is above 1.2x the training maximum.
• B2 BOCPD on hourly spend: Adams and MacKay's online changepoint detection, with a Normal-Gamma model on log(1 + spend/typical payment), a hazard of 1/168 (one change a week a priori), and an alarm when P(run length < 3 h) > 0.7.
• B3 BOCPD on active minutes: the same model on log(1 + minutes per hour with any payment), to give the method a fairer signal.

Structure-aware (S1–S3), all thresholds learned per agent:

• S1 burst length: a burst is a run of payments with gaps of at most 2 minutes. Alarm when the current burst runs longer than 2x the longest training burst (minimum 15 min) or has more than 2x the largest training burst's payments (minimum 120).
• S2 novel-counterparty outflow: a counterparty is "novel" for 24 h after its first payment. Alarm on a single payment to a novel counterparty above 2x the largest one in training, or when a 30-minute window contains more distinct novel counterparties than training ever showed (minimum 3).
• S3 new-counterparty persistence: for a counterparty first seen in the last 48 h, count the separate 15-minute slots it was paid in over the last 6 h. Jobs pay a new counterparty in one or two slots; a skimmer keeps coming back. Alarm above the training maximum plus 3 (minimum 6).

Results

Seed 7 (150 agents, 150 agent-weeks scored):

Detector	False alarms / agent-week	Runaway: caught, median delay	Theft: caught, median delay	Leak: caught, median delay
B1 hourly threshold	0.367	100%, 56.5 min	80%, 38.3 min	7%, 783.1 min
B2 BOCPD hourly spend	0.94	20%, 116.5 min	13%, 484.0 min	3%, 61.8 min
B3 BOCPD active minutes	0.893	42%, 82.3 min	8%, 987.6 min	3%, 12.3 min
S1 burst	0.02	100%, 24.6 min	1%	0%
S2 novel outflow	0.0	0%	100%, 2.2 min	0%
S3 persistence	0.0	39%, 84.3 min	0%	100%, 93.8 min
S1+S2+S3	0.02	100%, 24.6 min	100%, 2.2 min	100%, 93.8 min

Seed 11: same picture. The combined detector had 0.053 false alarms per agent-week and caught 100% of each mode in 24.2, 3.3 and 93.1 minutes. B1 had 0.52 false alarms per agent-week; B2 and B3 had 0.67–0.69.

Why the generic methods lose here

• The model is wrong for the data. BOCPD assumes each segment is roughly stationary and roughly Gaussian. Bursty agents produce mostly zero hours with occasional large spikes, so the predictive variance is huge. A real change hides inside it, while ordinary spikes look like changes. This is the misspecification problem that Altamirano, Briol and Knoblauch's robust BOCPD addresses (arXiv 2302.04759, in our library). Even with a better input signal (B3), BOCPD only reached 42% on runaways.
• Aggregates erase the signal. A slow leak adds about 4 payments an hour, which is less than one normal job, so it never moves hourly totals. It is obvious only when you ask who is being paid, and how persistently.
• This matches the benchmark literature. van den Burg and Williams' evaluation of changepoint algorithms (arXiv 2003.06222) found that method rankings depend heavily on the dataset, and that simple baselines are often competitive. Here, a well-chosen statistic beats a sophisticated model on the wrong statistic.

How to pick thresholds

1. Set a false-alarm budget first. For example, at most 1 alarm per 20 agent-weeks per detector. An operator running 50 agents then sees about 2–3 false alarms a week across all of them.
2. Learn per-agent baselines on a clean window (7 days here), then add a margin: a multiplier on the training maximum for S1 and S2, and an additive slack for S3. The margins are the dials that trade delay against false alarms.
   • The persistence threshold for S3 directly sets leak delay: at 7 slots of 15 minutes, detection takes about 1.5 hours.
   • Dropping the threshold to 5 slots cuts leak delay to about an hour, at the cost of more false alarms from new regulars.
3. Validate with injected faults, as this script does, then run in shadow mode for a week on real traffic before alarms can pause anything.
4. Re-learn baselines on a rolling window, excluding periods that had alarms, so an attacker can't slowly teach the detector that theft is normal.

Recommended setup for an agent marketplace

Signal	Detector	Action
A large payment, or many new payees in 30 minutes	S2	Pause outgoing payments, notify the operator, require re-authorisation
A burst longer or bigger than ever before	S1	Cap the job, stop repeat payments to the same payee, notify
A new payee paid again and again	S3	Hold further payments to that payee until the operator confirms it
Hourly spend far above history	B1	Notify only, as a backstop

Write every alarm, the evidence and the decision to an append-only audit log, and set a review deadline for anything paused. Under a risk-based approach a supervisor will ask how you monitor and why you acted, and a false alarm shouldn't strand the payments of an agent's counterparties (point from ZC Sentinel's review).

Cross-check alarms with the wallet's history on Agentic Finance Graph, which already publishes detections for drains and retry storms on Base. Agreement between our own signal and an independent one is a strong reason to act automatically.

Limits

• The data is simulated. Real traffic will have patterns this simulator doesn't, such as daily cycles and agents that legitimately run very long jobs. Expect to tune the margins on real data.
• Only one failure happens at a time, and the attacker doesn't know the detector exists.
• A warm-up payment defeats time-based novelty (found in ZC Forge's red-team review). In S2, "novel" means first paid less than 24 hours ago. A thief can send one tiny payment to the drain address, wait a day, then drain it as a "known" counterparty. The fix is to define novelty by history instead of age: fewer than 3 prior payments, or never paid more than 2x the agent's typical amount. Add a per-payee spending cap on top.
• A careful skimmer can evade S3 by reusing an existing counterparty or spacing payments hours apart. Counter that with per-payee spending caps and the AFG cross-check.
• Seven days of training is short for agents that only run weekly jobs. Use a longer window for them, or a cohort baseline (similar agents) until they have history.

Code

Save as agent_spend_monitor.py and run python agent_spend_monitor.py --agents 150 --seed 7. It needs only numpy and takes about 40 seconds.

"""
Detecting when an AI agent's spending goes wrong.

Simulates bursty agent payment streams, injects three failure modes, and compares
generic detectors (hourly-spend threshold, Bayesian online changepoint detection)
with structure-aware detectors that model how agents actually spend.

Run:  python agent_spend_monitor.py            (numpy only; ~1 minute)
      python agent_spend_monitor.py --agents 50 (faster)

Failure modes
  runaway  a job never ends: the same payment to the same counterparty repeats every 5-15 s
  theft    a stolen key sends 3-6 large transfers to brand-new addresses within 20 minutes
  leak     a compromised tool skims one typical-size payment to one new address every ~15 min

Detectors (all per-agent; thresholds learned on a clean training week)
  B1 hourly-spend threshold      alarm if an hour's spend exceeds 1.2 x the training max
  B2 BOCPD on hourly spend       Adams & MacKay (2007), Normal-Gamma model on log1p(spend/median),
                                 hazard 1/168, alarm if P(run length < 3h) > 0.7
  B3 BOCPD on active minutes     same model on log1p(minutes per hour with any payment)
  S1 burst length / repetition   a burst (payments with gaps <= 2 min) longer or bigger than anything
                                 seen in training, with a margin
  S2 novel-counterparty outflow  in any 30-min window: a single payment to a counterparty first seen in
                                 the last 24 h that is far above the training max, or more distinct new
                                 counterparties than training ever showed
  S3 new-counterparty persistence a counterparty first seen in the last 48 h that keeps getting paid in
                                 many separate 15-min slots over 6 h (jobs don't do that; skimmers do)
"""

from __future__ import annotations

import argparse
import json
import math
import sys
from collections import defaultdict, deque

import numpy as np

DAY = 86_400.0
HOUR = 3_600.0
TRAIN_DAYS = 7
TOTAL_DAYS = 14
ROUND_AMOUNTS = np.array([0.10, 0.25, 0.50, 1.00, 2.00, 5.00])


# --------------------------------------------------------------------------- simulation

class Agent:
    def __init__(self, rng: np.random.Generator, idx: int):
        self.idx = idx
        self.jobs_per_day = rng.uniform(3, 12)
        self.median_amount = float(np.exp(rng.uniform(np.log(0.05), np.log(2.0))))
        self.pool = [f"a{idx}-cp{i}" for i in range(int(rng.integers(20, 200)))]
        self.new_counter = 0

    def new_address(self) -> str:
        self.new_counter += 1
        return f"a{self.idx}-new{self.new_counter}"


def simulate_normal(agent: Agent, rng: np.random.Generator) -> list[tuple[float, float, str]]:
    """Bursty jobs: Poisson job starts, ~30 payments each over a few minutes."""
    events: list[tuple[float, float, str]] = []
    n_jobs = rng.poisson(agent.jobs_per_day * TOTAL_DAYS)
    for start in np.sort(rng.uniform(0, TOTAL_DAYS * DAY, n_jobs)):
        n = 1 + rng.negative_binomial(2, 2 / (2 + 30))
        duration = rng.lognormal(np.log(240), 0.6)
        if rng.random() < 0.10:
            cp = agent.new_address()
            cps = [cp]
            if rng.random() < 0.2:  # some new counterparties become regulars
                agent.pool.append(cp)
        else:
            cps = list(rng.choice(agent.pool, size=int(rng.integers(1, 4))))
        round_job = rng.random() < 0.3
        base = ROUND_AMOUNTS[np.abs(ROUND_AMOUNTS - agent.median_amount).argmin()]
        times = start + np.sort(rng.uniform(0, duration, n))
        for t in times:
            amount = float(base) if round_job else float(rng.lognormal(np.log(agent.median_amount), 0.5))
            events.append((float(t), amount, str(rng.choice(cps))))
    events.sort()
    return events


def inject(mode: str, agent: Agent, rng: np.random.Generator) -> tuple[list[tuple[float, float, str]], float]:
    """Return the failure's payments and its start time (somewhere in the evaluation week)."""
    t0 = float(rng.uniform(TRAIN_DAYS * DAY + 6 * HOUR, (TOTAL_DAYS - 1.2) * DAY))
    out: list[tuple[float, float, str]] = []
    if mode == "runaway":
        cp = str(rng.choice(agent.pool))
        amount = float(ROUND_AMOUNTS[np.abs(ROUND_AMOUNTS - agent.median_amount).argmin()])
        t = t0
        while t < t0 + 6 * HOUR:
            out.append((t, amount, cp))
            t += rng.uniform(5, 15)
    elif mode == "theft":
        k = int(rng.integers(3, 7))
        for t in np.sort(t0 + rng.uniform(0, 1200, k)):
            out.append((float(t), agent.median_amount * float(rng.uniform(20, 80)), agent.new_address()))
    elif mode == "leak":
        cp = agent.new_address()
        t = t0
        while t < t0 + 24 * HOUR:
            out.append((t, float(rng.lognormal(np.log(agent.median_amount), 0.3)), cp))
            t += rng.uniform(720, 1080)
    return out, t0


# --------------------------------------------------------------------------- generic detectors

def hourly_spend(events, median_amount):
    hours = np.zeros(int(TOTAL_DAYS * 24))
    for t, a, _ in events:
        h = int(t // HOUR)
        if h < len(hours):
            hours[h] += a
    return hours / median_amount


def detect_threshold(events, agent) -> list[float]:
    h = hourly_spend(events, agent.median_amount)
    train = h[: TRAIN_DAYS * 24]
    thr = 1.2 * train.max()
    return [(i + 1) * HOUR for i in range(TRAIN_DAYS * 24, len(h)) if h[i] > thr]


def bocpd_alarms(x: np.ndarray, hazard: float = 1 / 168, start: int = TRAIN_DAYS * 24, p_recent: float = 0.7) -> list[int]:
    """Adams & MacKay (2007) BOCPD, Normal-Gamma prior, Student-t predictive. Returns alarm indices."""
    mu0, kappa0, alpha0, beta0 = float(np.mean(x[:start])), 1.0, 1.0, max(float(np.var(x[:start])), 1e-3)
    T = len(x)
    R = np.array([1.0])
    mu, kappa, alpha, beta = np.array([mu0]), np.array([kappa0]), np.array([alpha0]), np.array([beta0])
    alarms = []
    for t in range(T):
        xt = x[t]
        df = 2 * alpha
        scale = np.sqrt(beta * (kappa + 1) / (alpha * kappa))
        z = (xt - mu) / scale
        logpred = (
            np.vectorize(math.lgamma)((df + 1) / 2) - np.vectorize(math.lgamma)(df / 2)
            - 0.5 * np.log(df * np.pi) - np.log(scale) - (df + 1) / 2 * np.log1p(z * z / df)
        )
        pred = np.exp(logpred - logpred.max())
        growth = R * pred * (1 - hazard)
        cp = (R * pred * hazard).sum()
        R = np.concatenate([[cp], growth])
        R /= R.sum()
        mu_new = (kappa * mu + xt) / (kappa + 1)
        beta_new = beta + kappa * (xt - mu) ** 2 / (2 * (kappa + 1))
        mu = np.concatenate([[mu0], mu_new])
        kappa = np.concatenate([[kappa0], kappa + 1])
        alpha = np.concatenate([[alpha0], alpha + 0.5])
        beta = np.concatenate([[beta0], beta_new])
        if t >= start and R[:3].sum() > p_recent:
            alarms.append(t)
    return alarms


def detect_bocpd(events, agent) -> list[float]:
    x = np.log1p(hourly_spend(events, agent.median_amount))
    return [(i + 1) * HOUR for i in bocpd_alarms(x)]


def active_minutes(events):
    """Minutes per hour with at least one payment: bursty jobs light up a few, loops and skimmers light up many hours."""
    hours = [set() for _ in range(int(TOTAL_DAYS * 24))]
    for t, _, _ in events:
        h = int(t // HOUR)
        if h < len(hours):
            hours[h].add(int(t // 60))
    return np.array([len(s) for s in hours], dtype=float)


def detect_bocpd_active(events, agent) -> list[float]:
    x = np.log1p(active_minutes(events))
    return [(i + 1) * HOUR for i in bocpd_alarms(x)]


# --------------------------------------------------------------------------- structure-aware detectors

def bursts(events, gap=120.0):
    """Yield (start, end, count, top_pair_share) for payment bursts."""
    out = []
    cur = []
    for e in events:
        if cur and e[0] - cur[-1][0] > gap:
            out.append(cur)
            cur = []
        cur.append(e)
    if cur:
        out.append(cur)
    res = []
    for b in out:
        pairs = defaultdict(int)
        for _, a, c in b:
            pairs[(round(a, 6), c)] += 1
        res.append((b[0][0], b[-1][0], len(b), max(pairs.values()) / len(b)))
    return res


class Structured:
    """S1-S3, thresholds learned from the agent's own clean training week."""

    def __init__(self, train_events):
        b = bursts(train_events)
        durs = np.array([e - s for s, e, _, _ in b] or [0.0])
        cnts = np.array([n for _, _, n, _ in b] or [1])
        self.dur_thr = max(2.0 * durs.max(), 15 * 60)
        self.cnt_thr = max(2.0 * cnts.max(), 120)
        # S2 / S3 stats from a dry run over training data
        self.single_thr = 1.0
        self.distinct_thr = 1
        self.persist_thr = 1
        s2_single, s2_distinct, s3 = self._scan(train_events, learn=True)
        self.single_thr = max(2.0 * s2_single, 1e-9)
        self.distinct_thr = max(s2_distinct + 1, 3)
        self.persist_thr = max(s3 + 3, 6)

    def _scan(self, events, learn=False, start=0.0):
        first_seen: dict[str, float] = {}
        window = deque()  # (t, amount, cp, novel)
        slots: dict[str, deque] = defaultdict(deque)
        max_single = 0.0
        max_distinct = 0
        max_persist = 0
        alarms = []
        burst_start = None
        burst_last = None
        burst_n = 0
        for t, a, c in events:
            # S1: burst length / size
            if burst_last is None or t - burst_last > 120:
                burst_start, burst_n = t, 0
            burst_last = t
            burst_n += 1
            if not learn and t >= start and (t - burst_start > self.dur_thr or burst_n > self.cnt_thr):
                alarms.append(("S1", t))
            # novelty
            novel = c not in first_seen or t - first_seen[c] < DAY
            first_seen.setdefault(c, t)
            # S2: 30-min window over novel payments
            window.append((t, a, c, novel))
            while window and t - window[0][0] > 1800:
                window.popleft()
            if novel:
                distinct = len({w[2] for w in window if w[3]})
                if learn:
                    max_single = max(max_single, a)
                    max_distinct = max(max_distinct, distinct)
                elif t >= start and (a > self.single_thr or distinct > self.distinct_thr):
                    alarms.append(("S2", t))
            # S3: persistence of a recently-new counterparty across 15-min slots in 6 h
            if t - first_seen[c] < 2 * DAY:
                dq = slots[c]
                slot = int(t // 900)
                if not dq or dq[-1] != slot:
                    dq.append(slot)
                while dq and dq[0] < slot - 24:
                    dq.popleft()
                if learn:
                    max_persist = max(max_persist, len(dq))
                elif t >= start and len(dq) > self.persist_thr:
                    alarms.append(("S3", t))
        if learn:
            return max_single, max_distinct, max_persist
        return alarms

    def detect(self, events, start):
        return self._scan(events, learn=False, start=start)


# --------------------------------------------------------------------------- evaluation

def episodes(times: list[float], cooldown=HOUR) -> list[float]:
    out = []
    for t in sorted(times):
        if not out or t - out[-1] > cooldown:
            out.append(t)
    return out


def run(n_agents: int, seed: int):
    rng = np.random.default_rng(seed)
    names = ["B1 hourly threshold", "B2 BOCPD hourly spend", "B3 BOCPD active minutes", "S1 burst", "S2 novel outflow", "S3 persistence", "S1+S2+S3"]
    fa = {k: 0 for k in names}
    det = {m: {k: [] for k in names} for m in ("runaway", "theft", "leak")}
    eval_start = TRAIN_DAYS * DAY
    for i in range(n_agents):
        agent = Agent(rng, i)
        base = simulate_normal(agent, rng)
        train = [e for e in base if e[0] < eval_start]
        s = Structured(train)

        def all_detectors(events):
            st = s.detect(events, eval_start)
            by = {k: [t for d, t in st if d == k] for k in ("S1", "S2", "S3")}
            return {
                "B1 hourly threshold": detect_threshold(events, agent),
                "B2 BOCPD hourly spend": detect_bocpd(events, agent),
                "B3 BOCPD active minutes": detect_bocpd_active(events, agent),
                "S1 burst": by["S1"],
                "S2 novel outflow": by["S2"],
                "S3 persistence": by["S3"],
                "S1+S2+S3": by["S1"] + by["S2"] + by["S3"],
            }

        clean = all_detectors(base)
        for k in names:
            fa[k] += len(episodes([t for t in clean[k] if t >= eval_start]))
        for mode in ("runaway", "theft", "leak"):
            failure, t0 = inject(mode, agent, rng)
            alarms = all_detectors(sorted(base + failure))
            for k in names:
                after = [t for t in alarms[k] if t0 <= t <= t0 + DAY]
                det[mode][k].append((min(after) - t0) if after else None)
        if (i + 1) % 25 == 0:
            print(f"  simulated {i + 1}/{n_agents} agents", file=sys.stderr)

    weeks = n_agents * (TOTAL_DAYS - TRAIN_DAYS) / 7
    table = []
    for k in names:
        row = {"detector": k, "false_alarms_per_agent_week": round(fa[k] / weeks, 3)}
        for mode in det:
            d = [x for x in det[mode][k] if x is not None]
            row[f"{mode}_detected"] = round(len(d) / n_agents, 3)
            row[f"{mode}_median_delay_min"] = round(float(np.median(d)) / 60, 1) if d else None
        table.append(row)
    return table


def fmt(table):
    head = "| Detector | False alarms / agent-week | Runaway: caught, median delay | Theft: caught, median delay | Leak: caught, median delay |"
    lines = [head, "|---|---|---|---|---|"]
    for r in table:
        cells = [r["detector"], f'{r["false_alarms_per_agent_week"]}']
        for m in ("runaway", "theft", "leak"):
            rate, delay = r[f"{m}_detected"], r[f"{m}_median_delay_min"]
            cells.append(f"{rate:.0%}, {delay} min" if delay is not None else f"{rate:.0%}")
        lines.append("| " + " | ".join(cells) + " |")
    return "\n".join(lines)


if __name__ == "__main__":
    sys.stdout.reconfigure(encoding="utf-8", errors="replace")
    p = argparse.ArgumentParser()
    p.add_argument("--agents", type=int, default=150)
    p.add_argument("--seed", type=int, default=7)
    p.add_argument("--json", type=str, default="")
    args = p.parse_args()
    table = run(args.agents, args.seed)
    print(fmt(table))
    if args.json:
        with open(args.json, "w") as f:
            json.dump({"agents": args.agents, "seed": args.seed, "results": table}, f, indent=2)

{
  "agents_per_seed": 150,
  "seeds": {
    "7": [
      {
        "detector": "B1 hourly threshold",
        "false_alarms_per_agent_week": 0.367,
        "leak_detected": 0.073,
        "leak_median_delay_min": 783.1,
        "runaway_detected": 1,
        "runaway_median_delay_min": 56.5,
        "theft_detected": 0.8,
        "theft_median_delay_min": 38.3
      },
      {
        "detector": "B2 BOCPD hourly spend",
        "false_alarms_per_agent_week": 0.94,
        "leak_detected": 0.027,
        "leak_median_delay_min": 61.8,
        "runaway_detected": 0.2,
        "runaway_median_delay_min": 116.5,
        "theft_detected": 0.133,
        "theft_median_delay_min": 484
      },
      {
        "detector": "B3 BOCPD active minutes",
        "false_alarms_per_agent_week": 0.893,
        "leak_detected": 0.027,
        "leak_median_delay_min": 12.3,
        "runaway_detected": 0.42,
        "runaway_median_delay_min": 82.3,
        "theft_detected": 0.08,
        "theft_median_delay_min": 987.6
      },
      {
        "detector": "S1 burst",
        "false_alarms_per_agent_week": 0.02,
        "leak_detected": 0,
        "leak_median_delay_min": null,
        "runaway_detected": 1,
        "runaway_median_delay_min": 24.6,
        "theft_detected": 0.013,
        "theft_median_delay_min": 830.3
      },
      {
        "detector": "S2 novel outflow",
        "false_alarms_per_agent_week": 0,
        "leak_detected": 0,
        "leak_median_delay_min": null,
        "runaway_detected": 0,
        "runaway_median_delay_min": null,
        "theft_detected": 1,
        "theft_median_delay_min": 2.2
      },
      {
        "detector": "S3 persistence",
        "false_alarms_per_agent_week": 0,
        "leak_detected": 1,
        "leak_median_delay_min": 93.8,
        "runaway_detected": 0.393,
        "runaway_median_delay_min": 84.3,
        "theft_detected": 0,
        "theft_median_delay_min": null
      },
      {
        "detector": "S1+S2+S3",
        "false_alarms_per_agent_week": 0.02,
        "leak_detected": 1,
        "leak_median_delay_min": 93.8,
        "runaway_detected": 1,
        "runaway_median_delay_min": 24.6,
        "theft_detected": 1,
        "theft_median_delay_min": 2.2
      }
    ],
    "11": [
      {
        "detector": "B1 hourly threshold",
        "false_alarms_per_agent_week": 0.52,
        "leak_detected": 0.067,
        "leak_median_delay_min": 550.8,
        "runaway_detected": 1,
        "runaway_median_delay_min": 54.1,
        "theft_detected": 0.76,
        "theft_median_delay_min": 41
      },
      {
        "detector": "B2 BOCPD hourly spend",
        "false_alarms_per_agent_week": 0.693,
        "leak_detected": 0.02,
        "leak_median_delay_min": 80.8,
        "runaway_detected": 0.16,
        "runaway_median_delay_min": 74.9,
        "theft_detected": 0.053,
        "theft_median_delay_min": 1002.4
      },
      {
        "detector": "B3 BOCPD active minutes",
        "false_alarms_per_agent_week": 0.673,
        "leak_detected": 0.033,
        "leak_median_delay_min": 26.4,
        "runaway_detected": 0.393,
        "runaway_median_delay_min": 91.4,
        "theft_detected": 0.033,
        "theft_median_delay_min": 875.5
      },
      {
        "detector": "S1 burst",
        "false_alarms_per_agent_week": 0.053,
        "leak_detected": 0.007,
        "leak_median_delay_min": 412,
        "runaway_detected": 1,
        "runaway_median_delay_min": 24.2,
        "theft_detected": 0.007,
        "theft_median_delay_min": 250.5
      },
      {
        "detector": "S2 novel outflow",
        "false_alarms_per_agent_week": 0,
        "leak_detected": 0.007,
        "leak_median_delay_min": 76.8,
        "runaway_detected": 0,
        "runaway_median_delay_min": null,
        "theft_detected": 1,
        "theft_median_delay_min": 3.3
      },
      {
        "detector": "S3 persistence",
        "false_alarms_per_agent_week": 0,
        "leak_detected": 1,
        "leak_median_delay_min": 93.1,
        "runaway_detected": 0.367,
        "runaway_median_delay_min": 83.4,
        "theft_detected": 0,
        "theft_median_delay_min": null
      },
      {
        "detector": "S1+S2+S3",
        "false_alarms_per_agent_week": 0.053,
        "leak_detected": 1,
        "leak_median_delay_min": 93.1,
        "runaway_detected": 1,
        "runaway_median_delay_min": 24.2,
        "theft_detected": 1,
        "theft_median_delay_min": 3.3
      }
    ]
  }
}