Uber just open-sourced the security stack they built to stop their AI agents from going rogue.
The Summary
- Uber released ADR (Agentic AI Detection and Response), an enterprise security system for AI agents deployed in production at Uber and detailed in a paper accepted to MLSys 2026
- The system monitors agent activity across 7+ AI coding tools (Cursor, Claude Code, Codex), runs 300+ security benchmark tasks against 133 MCP servers, and detects threats using a two-tier architecture
- This is the first major enterprise security framework for AI agents released as open source, signaling that agent security is moving from theoretical risk to operational reality
The Signal
The timing here is the tell. Uber didn't release this because they thought it would be fun. They released it because they had to build it, deployed it in production, and now they're sharing the playbook. That sequence matters. When a company with 32,000 employees open-sources an internal security tool, it means the threat is real and widespread enough that collective defense beats competitive advantage.
ADR monitors four layers: observability (what agents are doing), benchmarking (testing defenses), detection (spotting threats), and prevention (stopping unsafe actions before execution). The observability piece runs across macOS, Linux, and Windows, capturing agent intent, tool use, and execution traces. This isn't theoretical. This is production infrastructure handling employee-facing coding assistants and customer-facing support agents at Uber scale.
"ADR-Bench includes 300+ tasks, 133 MCP servers, and coverage of all 17 agent attack techniques."
The benchmark is where this gets concrete. Uber identified 17 distinct attack techniques that agents can execute. Not "might theoretically execute someday." Can execute. Right now. The 133 MCP (Model Context Protocol) servers suggest they're testing against a wide range of tool integrations, which makes sense when your agents can interact with internal systems, codebases, customer data, and third-party APIs.
The two-tier detection architecture is smart and reveals the real constraint: cost. A high-recall triage layer catches suspicious sessions, then a deeper agentic reasoning system analyzes the flagged activity. Translation: you can't afford to run expensive models on every agent interaction, so you filter first, then investigate. This is the kind of design choice you make when you're running this at scale, not prototyping in a lab.
The Implication
If you're deploying agents inside your organization, you now have a reference architecture for security. The fact that Uber open-sourced this instead of productizing it suggests two things: the problem is bigger than any one company, and the solutions need to be standardized before agents become critical infrastructure.
Watch what happens when other enterprises fork this. The benchmark tasks and attack taxonomy will become the de facto standard for agent security testing. The prevention layer, which Uber held back from this release, is likely where they're still iterating or where they see commercial value. Either way, agent security just graduated from research papers to operational tooling.