The agent security system actually running at Uber

What it does

ADR is an enterprise security toolkit for AI agents. It captures telemetry from employee-facing tools like Cursor, Claude Code, and Codex across macOS, Linux, and Windows, runs a benchmark suite with 300+ tasks and 133 MCP servers to stress-test defenses against 17 attack techniques, and applies a two-tier detection pipeline that triages sessions with high recall before escalating suspicious ones to deeper reasoning. It is essentially a flight recorder and intrusion detector for software that can read files, call APIs, and talk to customers.

The interesting bit

Unlike most academic security prototypes, ADR runs in production at Uber, and the open-source release includes the actual sensor, benchmark, and detector described in an MLSys 2026 paper. The two-tier detection architecture—fast triage followed by deeper agentic reasoning—is designed to catch risky behavior without drowning operators in false positives.

Key highlights

• Captures agent intent, tool use, and execution traces across 7+ AI coding tools on macOS, Linux, and Windows, plus internal automation and customer-facing support agents.
• Ships with ADR-Bench: 300+ tasks, 133 MCP servers, and coverage of all 17 agent attack techniques for realistic red teaming.
• Uses a dual-agent detector that combines high-recall triage with deeper reasoning for suspicious sessions.
• Accepted to MLSys 2026; the open-source release reflects the production system Uber runs internally.
• Synthetic benchmark fixtures (fake credentials, emulated environments) are included for defensive security research.

Caveats

• The prevention component and the offline ADR Explorer red-teaming engine are not included in the open-source release.
• Running the default detector requires Anthropic and OpenAI API keys.
• Benchmark fixtures are synthetic—fake credentials and emulated environments—intended for defensive research only.

Verdict

Security teams operating AI agents in production should evaluate this; solo developers running local models for personal tasks can safely skip it.