Uber Open-Sources AI Agent Protection System ADR

Imagine this scenario: you allow developers to use coding assistants like Claude Code or Cursor. Agents freely navigate the console, execute commands, read files, and call external APIs via the Model Context Protocol (MCP). Suddenly, an unnoticeable prompt injection ends up in one of the files being processed. The agent reads the malicious instruction and quietly sends private keys to an external server.

Uber encountered this threat directly. To protect internal processes and client support bots, the company's engineers created the ADR system (Agentic AI Detection and Response). The authors recently open-sourced the project on GitHub and published a research paper for the MLSys 2026 conference.

What ADR consists of

Uber already uses ADR in production. Some components remain in the company's internal repositories (for example, the Prevention engine for automatic blocking of dangerous actions and the ADR Explorer automated audit tool). However, the main part of the architecture has been released under the Apache 2.0 license.

The open part of the project is divided into three blocks:

• Observability (Sensor). Collects and applies a unified schema to telemetry from 7+ popular development tools. Runs on macOS, Linux, and Windows.
• Benchmark (ADR-Bench). A testbed for security validation. Consists of 303 tasks, 133 MCP servers, and covers 17 attack techniques against autonomous agents.
• Detection (ADR Detector). A two-level module for threat detection in agent activity logs.

Telemetry collection without binding to a specific tool

The main challenge in tracking AI agents is log fragmentation. Cursor writes logs in one format, Claude Code in another, and an internal company bot in a third.

The Sensor module fetches raw events from each tool and normalizes them to a common format. It captures not just message text, but intent chains, specific function calls, and command execution results. This gives the security team a unified event stream regardless of which environment the engineer was working in.

After this, you can run a standard test scenario. If you don't have API keys on hand or don't want to spend tokens, the project includes a lightweight local validation mode:

Detailed instructions for reproducing the graphs and metrics from the research paper are available in the docs/REPRODUCIBILITY.md file.

Who should pay attention to the project

The repository has gathered about 650 stars so far, but its practical value is immediately apparent. Unlike many theoretical frameworks, ADR grew out of a real need for a large company to secure its employees.

The project will be useful for:

• Information security specialists looking for ways to control AI assistant usage within the company.
• Researchers who need a ready-made benchmark for testing LLM agent security.
• Developers of their own agents who want to study the telemetry collection and normalization scheme.

Of course, the open version doesn't yet include the automatic attack prevention module (Prevention). But even in its current state, ADR provides an excellent foundation for building a monitoring system for AI tools within a team.