As organizations rush to integrate AI agents like coding assistants and automated support bots into their workflows, a new and complex attack surface emerges. Traditional security tools are ill-equipped to understand the behavior of these agents, which can execute code, access internal systems, and interact with sensitive data. Uber's ADR (Agentic AI Detection and Response) is one of the first major open-source projects to tackle this problem head-on, offering a framework for observing, testing, and detecting threats in the world of enterprise AI agents.
Backed by a paper accepted at the prestigious MLSys 2026 conference and already deployed in production at Uber, ADR brings a level of engineering rigor that is often missing in the rapidly evolving AI security space. It is not a simple API firewall but a sophisticated system designed to provide deep visibility into agent activity.
What ADR Provides
The project is structured around three core open-source components, with a fourth, critical piece remaining proprietary.
First is ADR Observability, implemented through the ADR Sensor. This component is the foundation of the system. It collects detailed telemetry on agent actions, including their intent, the tools they use, and full execution traces. Crucially, it supports a range of popular agents like Cursor, Claude Code, and Codex across macOS, Linux, and Windows. For any security team, the ability to collect and normalize this data into a unified schema from a diverse set of tools is a massive first step towards effective monitoring.
Second is the ADR Benchmark, or ADR-Bench. This is arguably one of the most valuable contributions of the project. Security is meaningless without a way to measure it, and ADR-Bench provides a standardized way to test agent defenses under realistic enterprise scenarios. It includes over 300 tasks, a simulated environment with 133 Model Context Protocol (MCP) servers, and specific tests covering all 17 known agent attack techniques. The repository even includes detailed instructions for reproducing the paper's figures, lending significant credibility to its evaluation claims.
Third is the ADR Detection engine. This component analyzes the telemetry collected by the Sensor to identify risky behavior. It employs a clever two-tier architecture: a high-recall, low-cost triage model first flags potentially suspicious sessions, which are then passed to a more powerful and expensive agentic reasoning model for deeper analysis. This balances the need for broad coverage with the practical constraints of computational cost, making it a well-designed system for production environments.
Weaknesses and Missing Pieces
ADR's most significant weakness is what's not included in the repository. The fourth component described in the paper, ADR Prevention, is not open-source. This module is responsible for actively stopping unsafe actions before they cause harm. Without it, ADR is a powerful detection and alerting tool, but the "Response" part of its name is something you have to build yourself. An alert that an agent is attempting to exfiltrate data is useful, but the system won't actually block the attempt. Organizations must integrate ADR's alerts into their own Security Orchestration, Automation, and Response (SOAR) platforms to take action. Likewise, the ADR Explorer engine for pre-deployment red teaming remains internal to Uber.
Another point of friction is the potential deployment complexity. The quick start guide focuses on running the benchmark, which is relatively simple. However, rolling out the ADR Sensor to an entire company's worth of developers using different operating systems is a substantial operational challenge. The documentation provides a high-level overview but lacks a detailed guide for this kind of large-scale, heterogeneous deployment.
Community and Project Health
As a new project, ADR's community is small, with just over 500 stars on GitHub. However, its health indicators are strong. The project is actively maintained by its creators at Uber, with the last code push occurring just yesterday and a v1.0.0 tag for the sensor component released last week. The number of open issues is very low, at only seven, suggesting a responsive and focused development team. Being an official Uber project provides a degree of confidence in its long-term viability that many other new open-source tools lack.
How It Fits in Your Stack
ADR should be thought of as a specialized Security Information and Event Management (SIEM) system for AI agents. It is not a replacement for network firewalls or endpoint detection. Instead, it fills a critical new visibility gap. In a real-world stack, the ADR Sensor would be deployed on employee workstations and servers where AI agents are used. Its telemetry data would be streamed to a central data lake or security analytics platform. The ADR Detector would run against this data stream, and its findings would be converted into alerts. These alerts would then feed into an existing incident response workflow, where security analysts can investigate and manually or automatically take action, such as disabling a user's API key or isolating a machine. ADR provides the critical detection piece, but the connective tissue to your existing security infrastructure is something you must build.