ADR: AI Agent Security for Enterprise Agents
ADR (Agentic AI Detection and Response) is Uber's open-sourced toolkit for watching what AI coding agents do and catching risky sessions before they cause harm. The released pieces — Sensor, ADR-Bench, and Detector — form a working system, not a demo: the two-tier detector is a sound design. Reach for it to benchmark your agent-security setup against documented attack techniques; skip it if you need automated blocking, since Prevention isn't released yet.
What is ADR?
ADR (Agentic AI Detection and Response) serves as an enterprise security system, which Uber created to protect various AI agents (e.g., Cursor, Claude Code, and Codex) and customer-facing support agents, as stated in the README. It captures what an agent intended to do and what tools it called, then runs that trace through a detector flagging suspicious sessions. The open-source release covers the Sensor, ADR-Bench, and Detector — not the Prevention component that blocks unsafe actions.
The Challenge of AI Agent Security
Enterprises rolling out coding agents like Cursor, Claude Code, and Codex to employees, plus their own customer-facing support agents, have no shared way to see what those agents did during a session or to test whether their guardrails catch a prompt injection before it reaches a tool call. Security teams handling enterprise AI security end up trusting agent output on faith or building one-off logging per tool. ADR's README frames this directly: without AI agent observability and a benchmark covering real attack techniques, teams can't tell whether their defenses work until an incident happens.
Core Capabilities of ADR
- ✓ADR Observability tracks what an AI agent actually did — its goal, which tools it invoked, and the full execution trail behind each action — spanning 7+ coding assistants, whether they're running on macOS, Linux, or Windows, doing internal automation work, or handling customer support directly.
- ✓Comprising 300+ tasks and utilizing 133 MCP servers, ADR-Bench tests agent security, covering all 17 documented agent attack techniques.
- ✓The ADR Detector runs a two-tier architecture: a high-recall triage pass first, then deeper agentic reasoning only on sessions it flags as suspicious.
- ✓The Sensor component collects and normalizes telemetry from Claude Code, Cursor, Codex, and other tools into one unified schema, per Sensor/README.md.
- ✓docs/REPRODUCIBILITY.md walks through the full evaluation loop — inflating the packed benchmark, running detectors, and plotting the paper's figures.
- ✓A default `adr` dual-agent detector plus a keyless `llamafirewall` baseline let you smoke-test the pipeline before wiring in real API keys.
Getting Started with ADR Detection
Clone the repo, then set up the Detection component with uv and export your model API keys: ```bash git clone https://github.com/uber/ADR cd ADR/Detection uv sync export ANTHROPIC_API_KEY="..." OPENAI_API_KEY="..." ``` That covers Detection (ADR-Bench plus the Detector). Sensor setup — telemetry collection and the unified schema — is documented separately in Sensor/README.md; the main README doesn't spell out those install steps itself, so check that file directly.
Running the ADR Benchmark and Detector
The default detector is `adr`, Uber's dual-agent design; without API keys handy, swap in `--detector llamafirewall` for a keyless smoke test, per Detection/README.md. The full evaluation loop — inflating the packed benchmark, running detectors against it, and plotting the paper's figures — is documented step by step in docs/REPRODUCIBILITY.md, which is where you go to reproduce the MLSys 2026 paper's numbers. Command-level detail on the 133 MCP servers and the benchmark tasks lives in Detection/README.md alongside the detector baselines.
Strengths
- ✓Deployed in production at Uber and backed by a peer-reviewed MLSys 2026 paper — this isn't a research prototype nobody has run against real traffic.
- ✓The two-tier detector (fast triage, then deeper reasoning only on flagged sessions) is a sensible cost/accuracy trade-off instead of running full agentic reasoning on every session.
- ✓ADR-Bench's 133 MCP servers and 17 attack techniques give you a concrete, repeatable benchmark instead of a vague internal-testing claim.
- ✓Apache-2.0 licensing keeps the open-source pieces easy to adopt inside a commercial codebase.
Open-Source Release Scope
- △ADR Prevention — the piece that stops unsafe actions before they execute — isn't in this release; the README just says 'stay tuned.'
- △The offline ADR Explorer engine, used for pre-deployment red teaming, is also withheld from the open-source repo.
- △Detection/ ships with synthetic benchmark fixtures — fake credentials, emulated environments — rather than real production traffic, so benchmark scores reflect emulated attacks, not Uber's live traffic.
- △At 1,013 stars and 85 forks, this is a young release without a long history of third-party issue reports to judge stability from.
- △The Detection/benchmark/agentdojo/ module incorporates vendored third-party code, operating under its own MIT license; this arrangement stands apart from the repository's main Apache-2.0 license, a point advisable for flagging during any license review.
Other AI Agent Security Tools
Frequently Asked Questions
ADR (Agentic AI Detection and Response) is released under the Apache License 2.0, with one exception: the vendored Detection/benchmark/agentdojo/ code carries its own separate MIT license.
The open-source release includes the ADR Sensor (telemetry collection), ADR-Bench (the security benchmark), and the ADR Detector. The Prevention component and the offline ADR Explorer red-teaming engine are not included.
ADR (Agentic AI Detection and Response) is deployed in production at Uber, according to the project's README and its accompanying MLSys 2026 paper.
The ADR paper, accepted to MLSys 2026, is linked directly from the repo as a PDF, alongside a slide deck covering the same work.
ADR-Bench's benchmark fixtures in Detection/ are synthetic — fake credentials and emulated environments built for defensive security research, not real production traffic, per the repo's data notice.
Telemetry is gathered by ADR's Sensor from various AI coding tools, such as Claude Code, Cursor, and Codex, its README detailing support for 7+ AI coding tools that run on macOS, Linux, and Windows platforms, and also covering customer-facing support agents.
Best use cases
- •Benchmarking an in-house or vendor AI-agent security stack against ADR-Bench's 300+ tasks and 17 attack techniques before trusting it in production.
- •Standing up telemetry collection across Claude Code, Cursor, and Codex through one normalized schema instead of building per-tool logging from scratch.
- •Running the keyless `llamafirewall` baseline to sanity-check the detector pipeline before wiring in real API keys.
- •Reproducing the MLSys 2026 paper's figures and detection numbers via docs/REPRODUCIBILITY.md for an internal security review.
Who should try it — and who should skip
Try ADR if you're a security or platform team already running Claude Code, Cursor, or Codex internally and want a concrete benchmark — ADR-Bench's 300+ tasks and 133 MCP servers — to measure your detection setup against, or want a reference telemetry schema instead of building one from scratch. Skip it if you need automated blocking today: Prevention isn't open-sourced, so Detector output still has to feed your own response process. It's also not a fit if you want a single-file check — Sensor, Detection, and the benchmark form a multi-part system with real setup work (uv, API keys, MCP infrastructure).