Uber has released the detection layer of a security system it built to watch AI agents operating across its own engineering and support organizations. The project, called ADR (short for Agentic AI Detection and Response), shipped on GitHub under an Apache 2.0 license, alongside a research paper the company says was accepted to MLSys 2026. Twelve researchers are credited, led by Chenning Li.
That a company running coding agents at real operational scale decided its detection logic was worth publishing says more about what those agents are doing in production than a vendor pitch deck would. Uber built ADR to watch two different populations of agents: the coding tools its own engineers use daily, among them Codex, Cursor, and Claude Code, and the separate agents that handle customer support conversations. Monitoring both means Uber has telemetry on what happens when software with broad tool access and live credentials runs inside a company for months, not inside a lab demo.
What Uber open-sourced is narrower than the full system it runs internally. A sensor component normalizes raw telemetry, capturing what an agent intended to do and which tools it actually called, pulled from more than seven coding tools across three operating systems plus Uber’s internal automation and support bots. A benchmark, ADR-Bench, packages several hundred tasks and over a hundred simulated MCP servers (the protocol agents use to call external tools) to stress-test detectors against 17 distinct attack techniques. A two-stage detector then does the classification work itself: a fast pass tuned to catch nearly everything suspicious, followed by a slower reasoning pass that reviews only the flagged sessions before a human ever needs to look.
What Uber withheld is just as telling. An offline engine that red-teams the detector before it ships, and the prevention layer that actually blocks a flagged action, both remain proprietary. Uber published the diagnostic half of its agent-security stack and kept the enforcement half. That split tracks where the rest of the industry has landed on agent observability: companies will show how they detect a problem well before they hand over the mechanism that stops it, since a detector ages faster and carries less competitive weight than a production kill switch.
The 17-technique attack taxonomy inside ADR-Bench is the more durable piece of this release. It reads as a checklist of what a security team inside a large enterprise is actually finding once agents get real MCP access and real credentials, rather than the hypothetical prompt-injection scenarios that dominate academic papers. Any platform team running coding agents at scale, or evaluating an agentic vendor’s security claims, now has a public reference to test its own tooling against before an incident forces the comparison.
Uber’s data notice describes the benchmark’s credentials and attack scenarios as synthetic, built for defensive research rather than as a live catalog of exploited flaws, so the release documents a detection method more than a specific breach. Teams standing up MCP-connected agents this quarter should treat ADR-Bench’s attack list as a minimum bar for their own monitoring, whether or not they adopt Uber’s detector.
Released by Uber on GitHub, August 6, 2026.
