Uber's ADR shows enterprise AI security is becoming a detection problem

Uber has open-sourced ADR, an enterprise security system for AI agents that it says is deployed in production across its own fleet. The accompanying paper was accepted to MLSys 2026. The move is notable not just for what it secures, but for what it implies about how the industry now thinks about agent safety: this is a detection problem, not a policy problem.

ADR stands for Agentic AI Detection and Response. It secures employee-facing agents like Cursor, Claude Code, and Codex, plus customer-facing support agents. The system has four components: observability, a benchmark, detection, and prevention. Uber shipped three of them in this release. Prevention is explicitly excluded, with the repository noting “this component is not included in the current open-source release. Stay tuned.”

The most telling detail is the benchmark. ADR-Bench includes 300+ tasks, 133 MCP servers, and coverage of all 17 agent attack techniques. The Detection directory lists 303 benchmark tasks specifically. That is a serious attempt to measure agent security under realistic enterprise conditions, with synthetic fixtures that include fake credentials, emulated environments, and prompt-injection scenarios.

The shift from policy to runtime

Enterprise AI security has spent the last two years arguing about policy. Guardrails, system prompts, constitutional classifiers, and usage policies all assume you can constrain an agent before it acts. ADR assumes you cannot. Its architecture is built around observing what agents actually do, then detecting suspicious behavior in real time.

The detection component is a two-tier architecture. A high-recall triage layer flags suspicious sessions, then a deeper agentic reasoning layer investigates them. That design acknowledges a practical reality: agents generate enormous volumes of tool calls, and you cannot afford deep reasoning on all of them. You need a cheap filter in front of an expensive analyzer.

The observability component captures agent intent, tool use, and execution traces across 7+ AI coding tools on macOS, Linux, and Windows. That telemetry is the raw material for everything else. Without it, detection is blind. Uber’s bet is that the sensor layer is a commodity, and the detection layer is where the value lives.

A benchmark that takes attacks seriously

The 17 agent attack techniques covered by ADR-Bench is the number to sit with. Prompt injection is the obvious one, but the taxonomy extends to tool poisoning, context smuggling, credential exfiltration, and multi-step attacks that span sessions. The inclusion of 133 MCP servers matters too. MCP, or Model Context Protocol, is how agents plug into enterprise tools. Each server is an attack surface.

The benchmark’s design reflects a mature understanding of the threat model. Enterprise agents have access to codebases, internal APIs, and customer data. A compromised agent is not a nuisance; it is a data breach with a keyboard. ADR-Bench treats defense as a measured engineering discipline, with baselines and figure scripts included for reproducibility.

The paper’s author list is worth reading. Chenning Li, Pan Hu, Justin Xu, Baris Ozbas, Olivia Liu, Caroline Van, Manxue Li, Wei Zhou, Mohammad Alizadeh, Pengyu Zhang, KK Sriramadhesikan, and Ming Zhang. That is a mixed team of security researchers and systems people. The MLSys acceptance is fitting. This is a systems paper as much as a security paper.

What Uber is not releasing

The prevention component is the missing piece, and its absence is informative. Prevention stops unsafe actions before they cause harm. That requires enforcement authority, which means it sits in the critical path of agent execution. Open-sourcing that component would mean publishing the exact mechanisms Uber uses to block agent actions, which is both a security risk and a competitive one.

The ADR Explorer engine is also absent. It is described as an offline engine that hardens detection through pre-deployment red teaming. That is the tool that generates the adversarial scenarios used to train the detector. Keeping it proprietary means Uber retains the ability to generate novel attacks that its own detector has seen, and that external attackers have not.

This is a pattern worth noting. Uber is giving away the instrumentation and the evaluation harness, but keeping the enforcement and the red-teaming engine. That is a sensible open-source strategy. The community gets the measurement tools, and Uber keeps the defensive edge.

The AI security market is consolidating around detection

The timing matters. Agent deployment in enterprises has moved past the pilot phase. Companies are running coding agents across their engineering orgs, and support agents are handling customer-facing workloads. The security tooling has lagged behind. ADR is one of the first production-grade systems to address this gap, and its open-source release sets a baseline for what enterprise buyers should expect.

The two-tier detection architecture is likely to become the standard pattern. Cheap triage followed by expensive reasoning is the same approach used in email spam filtering, network intrusion detection, and fraud systems. Agents generate too much telemetry for deep analysis on every action. The economics force a tiered approach.

The benchmark is the more consequential contribution. A shared evaluation harness lets vendors compete on measured detection quality instead of marketing claims. The 303 tasks and 133 MCP servers give the community a common yardstick. That is how a security category matures.

What this means for AI builders

For teams building agentic systems, the lesson is that security must be instrumented from day one. The sensor layer is the foundation. If you are not collecting telemetry on agent intent, tool use, and execution traces, you cannot detect attacks after deployment. Retrofitting observability is always harder than building it in.

For security vendors, the bar just moved. A production system at Uber, with a published benchmark and an MLSys paper, sets the reference point. Vendors that cannot demonstrate detection quality on ADR-Bench or equivalent evaluations will struggle to justify their pricing.

The open-source release under Apache 2.0 lowers the barrier for adoption. The Sensor directory normalizes telemetry from Claude Code, Cursor, Codex, and others into a unified schema. That schema is the interoperability layer the ecosystem needs. If it becomes the de facto standard for agent telemetry, Uber has effectively set the protocol for agent security.

The quick start is straightforward: clone the repo, run uv sync, export Anthropic and OpenAI API keys, and run the detector. The default detector is the ADR dual-agent system, with a keyless smoke test option using llamafirewall. Reproducibility is taken seriously, with a documented workflow to inflate the packed benchmark, run detectors, and plot figures.

Uber has positioned itself as the reference implementation for enterprise agent security. The question now is whether the rest of the industry adopts the benchmark as the standard, or fragments into competing evaluations. The 17 attack techniques and 303 tasks are a strong starting point, but agent attacks will evolve. The benchmark will need maintenance, and Uber has not said how it will handle that going forward.

The prevention component remains the unknown. When it ships, it will complete the picture. For now, the industry has a measurement framework, a detection architecture, and a production deployment to learn from. That is more than most security categories get in a single release.