ADR: Uber's Enterprise Security System for AI Agents

Summary

ADR (Agentic AI Detection and Response) is an enterprise security system developed by Uber to secure AI agents. It offers critical capabilities like observability, security benchmarking, and threat detection, ensuring the safe operation of both employee and customer-facing AI applications. This open-source project is deployed in production at Uber and was accepted to MLSys 2026.

Use at your own risk

OSRepos shares public repositories for knowledge and discovery only. Any installation, execution, configuration, or use of code from these repositories is the user's own responsibility. Always review the repository, source code, dependencies, licenses, and security implications before running or installing anything. OSRepos is not responsible for issues, damages, or losses resulting from third-party repositories.

Introduction

ADR (Agentic AI Detection and Response) is an enterprise security system for AI agents, developed and deployed in production at Uber. It helps organizations secure various AI agents, including employee-facing tools like Cursor, Claude Code, and Codex, as well as customer-facing support agents. ADR achieves this through four complementary capabilities: observing agent activity, evaluating defenses, detecting threats, and preventing unsafe actions. The accompanying paper for ADR was accepted to MLSys 2026.

Installation

To get started with ADR Detection, follow these steps:

git clone https://github.com/uber/ADR
cd ADR/Detection
uv sync
export ANTHROPIC_API_KEY="..." OPENAI_API_KEY="..."

The default detector is adr (ADR dual-agent). For keyless smoke tests, you can use --detector llamafirewall. For the full evaluation workflow, including inflating packed benchmarks, running detectors, and plotting figures, refer to the reproducibility guide.

Examples

ADR is structured into several key components:

ADR Observability (Sensor): Collects and normalizes agent telemetry from various AI coding tools and agents, providing insights into their activity, tool use, and execution traces.
ADR Benchmark: Includes over 300 tasks, 133 Model Context Protocol (MCP) servers, and covers all 17 agent attack techniques to test agent security under realistic enterprise conditions.
ADR Detection: A dual-agent detector designed to efficiently detect risky agent behavior using a two-tier architecture.

For detailed documentation on each component, please see the links below.

Why Use ADR?

ADR offers a robust solution for securing AI agents within an enterprise environment. By leveraging ADR, organizations can:

Gain comprehensive visibility into what their AI agents are doing and why.
Proactively test and benchmark the security of their AI agents against a wide range of attack techniques.
Efficiently detect and respond to risky or malicious agent behavior.
Benefit from a system that has been deployed and hardened in production at Uber, ensuring reliability and effectiveness.