Uber Releases Open-Source Agent Security System ADR

Uber has developed and partially open-sourced an ADR (Agentic AI Detection and Response) system designed to monitor activities of coding agents (such as Claude Code and Cursor) and detect threats. It was designed to address the limitations of existing EDR tools, which fail to understand prompt or tool-call contexts.

The released components are ADR Sensor, ADR-Bench, and ADR Detector. ADR Sensor normalizes logs from 7 types of coding agents into a single schema, while ADR Detector operates with a two-stage structure combining a low-cost classification model and a high-cost inference model to reduce operational costs.

In the ADR-Bench benchmark (303 tasks), ADR achieved 100% precision, eliminating false positives, but showed a recall rate of 66.7%. This is an intentional design choice to minimize incident response costs caused by false positives in enterprise environments. The paper has been accepted to MLSys 2026 and is based on results from over 10 months of operation in Uber's production environment.