uber/ADR: Bringing the EDR Paradigm to AI Agent Security
> Original link: https://github.com/uber/ADR > Paper: ADR: An Agentic Detection System for Enterprise Agentic AI Security (MLSys 2026 Industry Track)
An Overlooked Fact: AI Agents Are Already Running in the Enterprise
On a day in 2026, Uber's security team stared at a dashboard and noticed something awkward: more than seven AI coding and automation tools, including Cursor, Claude Code, Codex, internal automation agents, and customer service agents, were running simultaneously across the company. Each one could invoke MCP, read and write files, send HTTP requests, and execute shell commands.
What are these agents doing? Why are they doing it? Has any of them been hijacked by prompt injection? No one could answer.
Uber did not lack security investments. The problem is that traditional security tools cannot see agents.
EDR (Endpoint Detection and Response) monitors processes, files, and network traffic. DLP monitors data egress. SIEM monitors logs. But agent behavior happens on a new continent: MCP calls, tool use, prompt injection hidden in context, and tool-return phishing. That continent has no sentinels.
Uber's response is to open-source uber/ADR, Agentic AI Detection and Response. The name is not a coincidence: it transplants the EDR paradigm into the agent world.
Four Pieces: Observability, Benchmark, Detection, Prevention
ADR is not a single-point tool but four interlocking components:
1. ADR Observability — The observability layer for agents. On macOS, Linux, and Windows, it captures agent intent, tool use, and execution traces from 7+ AI coding tools. Instead of asking "which process did the agent run?" it asks "what did the agent intend to do, which MCP did it call, and what is the execution chain?"
2. ADR Benchmark — A benchmark purpose-built for agent security: 300+ tasks, 133 MCP servers, covering all 17 known agent attack techniques. This is not a one-shot benchmark but a continuously regressing security test suite.
3. ADR Detection — A two-layer architecture: the first layer performs high-recall triage; the second layer applies deeper agentic reasoning. Coarse filtering first, deep analysis second, embodying the classic principle that division of labor beats unification — one model is fast but shallow, the other slow but precise.
4. ADR Prevention — Not yet open-sourced, with a "stay tuned" note.
Key Insight: Extending "Validation as a Control Signal" from Code to Agents
ADR's two-layer detection architecture echoes a line from the AREX paper: "Validation is not just a post-hoc filter; it defines the transition between research rounds."
ADR does the agent version of the same thing: instead of inspecting logs after an agent finishes, it uses validation signals during execution to decide the next step. The first-layer triage quickly filters clearly safe sessions and forwards suspicious ones to the second layer for deep reasoning — structurally identical to the agent's explore-validate-execute loop.
This architectural choice reflects an engineering reality: agent sessions are too long and too complex; single-layer detection is either too slow (everything goes deep) or too leaky (everything stays shallow). Two-layer division is the only design that survived ten months in production.
ADR-Bench: 133 MCP Servers and 17 Attack Techniques
The most interesting component is ADR-Bench. It is not another prompt-injection dataset but an enterprise-grade agent attack simulation environment:
- 300+ tasks: ranging from simple tool misuse to complex multi-step attacks
- 133 MCP servers: simulating the MCP ecosystem found in real enterprises (databases, file systems, APIs, internal tools)
- 17 attack techniques: prompt injection, tool poisoning, context hijacking, credential leakage, and more
- Deployment duration: 10+ months in Uber's production environment
- Tool coverage: 7+ AI coding tools (Claude Code, Cursor, Codex, etc.) plus internal automation and customer service agents
- Benchmark scale: 300+ tasks, 133 MCP servers, 17 attack techniques
- Academic recognition: Accepted at MLSys 2026 Industry Track
- License: Apache 2.0
The number 133 is not arbitrary. Uber really runs 133 MCP servers internally — it reflects their actual production scale. The benchmark was not built in a lab; it was cloned from the real battlefield.
Why This Matters: The "EDR Moment" of the Agent Era
In the 2010s, EDR emerged because traditional antivirus could not see fileless attacks or in-memory attacks. The same pattern is repeating now: traditional security cannot see prompt injection, MCP call chains, or agent context hijacking.
Every shift in computing paradigm creates a security blind spot, and the tools that fill the gap always borrow their paradigm from the old world. EDR filled the endpoint blind spot; ADR fills the agent blind spot. The shared name is not coincidence; it reflects paradigm isomorphism.
ADR does have a limitation — the open-source release includes only Sensor, Benchmark, and Detector. Prevention remains closed-source. That means the community can observe, benchmark, and detect, but cannot block. Uber has kept the sharpest piece for itself. This is understandable: prevention requires deep integration into enterprise workflows, which an open-source drop-in cannot deliver out of the box.
Data at a Glance
Lessons for Agent Developers
For anyone building agent systems, ADR offers three directly transferable design principles:
1. Observability first: Write the collection layer for "what the agent is doing" before writing the agent itself. Without observability, detection and prevention are empty talk. 2. Two-layer detection: Combine fast triage with deep reasoning; do not try to make one model do everything. Division of labor beats unification. 3. Benchmark as an asset: ADR-Bench itself is a security asset. Every newly discovered attack gets added back into the benchmark, forming a continuously regressing closed loop.
---
One-line summary: uber/ADR transplants the EDR paradigm into the agent world — observability, benchmark, detection, prevention. Uber open-sourced the first three and kept the sharpest fourth. But those three alone already draw a starting line for agent security.
> Repository: uber/ADR > Paper: arXiv:2605.17380 > MLSys 2026 Slides: PDF