Detects bursts of failed tool invocations against a single AWS Bedrock AgentCore Gateway within a short window. While individual tool calls may fail due to bad input or transient upstream issues, a concentrated spike of errors targeting one gateway can indicate probing of the gateway's parameter surface, a compromised tool wrapper, or an injection/authorization bypass attempt. This rule analyzes logs from the AWS Bedrock AgentCore gateway application logs (data_stream: aws_bedrock_agentcore.gateway_application_logs-*) and flags bursts where payload_object.isError is true. Failures are deduplicated by gateway.request_id and aggregated within a rolling window (from now to -60m, evaluated every 10m). A threshold of 1 with a cardinality of 10 means that a gateway experiencing errors across multiple distinct request IDs will trigger an alert. Operators should verify gateway and target health before treating a burst as adversarial and consider correlating with runtime agent logs to identify the caller. The rule maps to MITRE ATT&CK Initial Access (T1190) and MITRE ATLAS AML.T0053 (AI Agent Tool Invocation).