ADR (Agentic AI Detection and Response) is Uber’s open-source security system for enterprise AI agents. As coding assistants and autonomous agents spread across a company, they gain access to code, tickets and internal systems, and ADR gives security teams observability into what those agents do, benchmarks for agent-security risks, and threat detection for attacks such as prompt injection. ADR is deployed in production at Uber, its accompanying paper was accepted to MLSys 2026, and the repository has gathered around 2,100 GitHub stars since its 2026 release.
ADR is built to watch employee-facing agents such as Cursor, Claude Code, Codex and GitHub Copilot CLI, as well as customer-facing agents like AI support bots. It collects agent activity through hooks and MCP-aware instrumentation, evaluates behavior against security benchmarks covering tool misuse and prompt-injection scenarios, and flags anomalous or malicious sessions for responders. The repository includes the benchmarking harness, detection logic and documentation, including the full MLSys paper and slides.
Free. ADR is released under the Apache-2.0 license; organizations run it inside their own infrastructure.
Security and platform teams rolling out AI coding agents at scale who need visibility, benchmarking and detection for agent-specific threats before incidents happen.
ADR’s design reflects how enterprises actually deploy agents: employees run coding assistants with broad repository and ticket-system access, so ADR focuses on collecting fine-grained activity records, replaying risky behaviors against a benchmark suite, and alerting on patterns such as unexpected tool calls or attempts to reach restricted resources. The repository ships the benchmark definitions alongside the detection code, so other organizations can reproduce Uber’s published results and adapt the thresholds to their own risk tolerance.