ADR (Agentic AI Detection and Response) is Uber's open-source system for discovering, observing, and detecting threats against enterprise AI coding agents, built for defensive security teams.
| Tool | uber/ADR — enterprise Agentic AI Detection and Response system for securing AI agents |
| Category | AI agent security monitoring and detection platform (Python) |
| Primary Use | Inventorying unsanctioned AI tooling on endpoints, collecting normalized agent telemetry, benchmarking agent defenses with ADR-Bench, and detecting risky agent behavior |
| Safe Use | Purely defensive research and monitoring: deployed for authorized enterprise security operations, purple-team benchmarking on synthetic fixtures, and red-team hardening of one's own agent fleet |
| Telemetry Note | ADR is itself a telemetry collector: defenders gain unified session traces from tools like Claude Code and Cursor, while ADR Discovery reveals AI app inventories on endpoints — useful dual visibility for blue teams |
ADR — short for Agentic AI Detection and Response — is uber/ADR, an open-source Python security system that addresses a problem most enterprises are only now recognizing: employees are running autonomous coding agents like Cursor, Claude Code, Codex, GitHub Copilot CLI, and DeepSeek Harness on corporate endpoints, and nobody has unified visibility into what those agents are actually doing. What makes this repository notable is its provenance. The README states plainly that ADR is deployed in production at Uber, and the accompanying research paper was accepted to MLSys 2026, with both the paper PDF and slides included in the repo under docs/. At roughly 1,568 stars and licensed under Apache-2.0, it reads as a serious engineering artifact rather than a research prototype, and the Detection/ tree even vendors agentdojo under its own MIT license rather than reimplementing it.
The architecture decomposes into five complementary capabilities, four of which ship in this release. ADR Discovery inventories the AI attack surface on an endpoint: installed AI applications, CLI agents, IDE extensions, local model runtimes, and MCP (Model Context Protocol) servers, flagging unknown surfaces for review. ADR Observability captures agent intent, tool use, and execution traces across what the README describes as 7+ AI coding tools on macOS, Linux, and Windows, plus internal automation and customer-facing support agents. ADR Benchmark (ADR-Bench) and ADR Detection round out the open-source portion, while ADR Prevention — the blocking component — is explicitly excluded from the current release, and the offline ADR Explorer red-teaming engine is likewise absent. For an operator evaluating coverage, that transparency about what is and isn't shipped is a good sign.
The repository layout maps cleanly onto the paper's components. Discovery/ contains the endpoint inventory probes and a fingerprint catalog used to classify detected AI tooling. Sensor/ handles telemetry collection and normalization into a unified schema, which is the quiet architectural keystone here — heterogeneous agents each emit logs in their own formats, and unified normalization is what makes downstream detection tractable. Detection/ bundles the dual-agent detector, the ADR-Bench benchmark infrastructure spanning 134 MCP servers and 304 benchmark tasks, baseline detectors, and figure scripts. docs/REPRODUCIBILITY.md documents a step-by-step evaluation workflow to reproduce the paper's detection results and figures, which signals the authors expect third parties to verify their claims.
The detection design is worth pausing on. ADR uses a two-tier architecture: a high-recall triage layer that cheaply screens agent sessions for suspicion, followed by deeper agentic reasoning applied only to sessions the triage tier flags. This is a cost-driven pattern familiar from traditional detection engineering — you cannot run an expensive LLM-based reasoning pass over every agent session, so you stage cheap filters ahead of expensive analysis. The default detector is selected with --detector adr (the dual-agent configuration), and the README notes a keyless alternative via --detector llamafirewall for smoke testing without API credentials, which lowers the barrier to a first evaluation considerably.
ADR-Bench is arguably the most immediately reusable piece for practitioners. With 300+ tasks, coverage of all 17 documented agent attack techniques (prompt injection being the headline category given the repo's topic tags), and a corpus of 134 emulated MCP servers, it provides a realistic enterprise-flavored testbed for measuring how any detector — not just ADR's — performs against agentic threats. The tasks simulate environments where agents handle tools and credentials under adversarial pressure. Importantly, the data notice is explicit that all Detection/ fixtures are synthetic: fake credentials, emulated environments, and prompt-injection scenarios constructed purely for defensive security research, with details in docs/OPEN_SOURCE_REVIEW.md. There are no live targets, no real infrastructure, and nothing weaponized.
Getting started is minimal. The quick start is a standard clone-and-sync: git clone https://github.com/uber/ADR, then cd ADR/Detection, uv sync, and export ANTHROPIC_API_KEY and OPENAI_API_KEY to run the dual-agent detector. The llamafirewall baseline path needs no keys at all. From there, Detection/README.md documents the benchmark, detector baselines, and MCP infrastructure, while Sensor/README.md covers telemetry collection — including a notable detail that the sensor also captures Gemini CLI session journals, with tool results and nested subagent sessions, across all three major operating systems.
Where does this fit in an authorized workflow? The most natural deployments are threefold. First, discovery: security teams can run ADR Discovery on managed endpoints to answer the question shadow-AI question — which coding agents and MCP servers exist that policy never approved. Second, observability: the sensor normalizes agent behavior into a schema that feeds a SOC's existing detection pipeline, giving analysts session-level context when an agent does something questionable. Third, evaluation: ADR-Bench lets a purple team measure detector efficacy against the full taxonomy of agent attack techniques before deploying anything to production, which is exactly the pre-deployment hardening loop the paper describes.
From a defensive telemetry perspective, ADR is interesting because it is simultaneously a sensor and a signal. The sensor's own output — normalized agent traces with intent, tool calls, and execution paths — is precisely the evidence a responder needs when investigating a prompt-injection incident or a misbehaving automation. Conversely, the existence of the Discovery component reflects an operational reality defenders should internalize: unsanctioned MCP servers and CLI agents on endpoints are now part of the attack surface, and inventorying them is the precondition for any meaningful control. Defenders watching for agentic risk should treat session journals, tool-invocation logs, and subagent spawning patterns as the core observables — and ADR Sensor collects all of them.
A few caveats temper the enthusiasm. The ADR Prevention capability — actually blocking unsafe actions — is not in this release, so this is detection and response tooling in the monitoring sense, not an enforcement layer. The offline ADR Explorer red-teaming engine that hardens detection is also withheld. Detection quality depends on the dual-agent LLM pipeline, which means API costs and latency are real operational considerations the two-tier triage mitigates but doesn't eliminate. And as with any production-derived system, what works at Uber's scale may need tuning for smaller fleets.
Those limitations aside, uber/ADR is one of the more substantial open-source entries in the emerging agent-security category. It combines endpoint inventory, telemetry normalization, a rigorous benchmark with full attack-technique coverage, and a cost-aware dual-agent detector, all documented through a peer-reviewed MLSys 2026 paper with a reproducibility guide. For security teams whose organizations are adopting AI coding agents faster than they are securing them, ADR offers a defensible, documented starting point for building that visibility — and its production deployment at Uber is the strongest evidence available that the design holds up under real load.
uber/ADR.Educational analysis for authorized security professionals. Use only in controlled, authorized environments.
Related coverage
0 comentários:
Post a Comment
Note: Only a member of this blog may post a comment.