Uber Open-Sources The Security System It Built Because Its AI Agents Had Become Invisible

Uber has released the internal tooling it uses to monitor AI agents running on employee machines, along with a benchmark built from its own production data. The company's argument is that the security industry spent a decade building tools that watch what software does, and agents have made that the wrong thing to watch.

In a post announcing the release, Uber CTO Praveen Neppalli Naga said the company's agents now run more than 50,000 sessions a day across thousands of endpoints, and that usage has moved well past the engineering org. Employees across Uber run agents that read code, execute commands, call internal tools, analyze data, and take action on live systems.

Traditional endpoint detection and response tools, the category that has anchored corporate security for years, record outcomes. A file was written. A network call went out. What they do not record is the prompt that caused it, or the reasoning the agent produced along the way. Naga's point is that intent is what separates a malicious session from a benign one, and intent is the part the existing stack cannot see.

Uber's answer is a system it calls Agentic Detection and Response, or ADR. The code, a detection framework, and a benchmark called ADR-Bench are now public on GitHub under an Apache 2.0 license.

What the system does

ADR has three pieces, described in a paper presented at MLSys 2026 by a team led by Chenning Li.

The ADR Sensor captures the full causal chain of an agent session: prompt, reasoning, tool call, outcome. It runs across the agents Uber employees actually use, including Cursor, Claude Code, and Codex, and it is built around the Model Context Protocol, the standard way agents now reach file systems, APIs, and databases.

The ADR Detector handles the volume problem. Running expensive LLM analysis on every session at Uber's scale would cost a fortune, so the detector works in two tiers. A fast, high recall first pass clears the flood of ordinary sessions. Only what survives triage gets the deeper treatment, where the analysis is enriched with source code, threat intelligence, and policy context.

The ADR Explorer is an offline engine that generates hard attack variants to harden the detector before deployment rather than after. It is not part of the open-source release, and neither is the ADR Prevention layer. Uber has published the observability and detection halves of the system and kept the red teaming engine and the blocking mechanism internal.

The production numbers, and the ones that did not make the post

Uber has been running ADR internally for more than ten months. In that time it surfaced hundreds of credential exposures across 26 categories, all of them credentials that had been shared outside the enterprise network. It also fed a shift-left prevention layer that catches secrets before they leave a laptop, reporting 97.2% precision on 206 detected credentials out of 212 unique ones found across hundreds of thousands of sessions.

The benchmark results deserve a closer look. ADR-Bench contains 302 tasks drawn from real production data, 42 of them malicious and 260 benign, spanning 133 MCP servers and covering all 17 attack techniques across 5 tactics. On it, ADR produces zero false positives and beats three existing baselines (ALRPHFS, GuardAgent, and LlamaFirewall) by two to four times in F1 score.

Zero false positives is the figure Uber leads with, and for an enterprise it is the right one, since every false alarm is a real incident response cycle spent on nothing. The paper notes that the baselines produced up to 40 false positives across the 260 benign tasks. The recall number is less flattering and did not make it into the announcement post: ADR detects 67% of the attacks in its own benchmark. On AgentDojo, the public prompt injection benchmark, the system caught every attack, though with three false alarms across 93 tasks.

Taken together, those numbers describe a system tuned to stay quiet. It will miss roughly a third of the attacks in the hardest benchmark its own authors could build, and in return it will almost never waste an analyst's time. For a company processing this volume that is a reasonable trade. Teams looking at the tooling should understand they are inheriting it.

There is also a gap between the paper and the post. The published research, from May, describes ADR running across 7,200 hosts and 10,000 agent sessions a day. Naga's number is now 50,000 sessions daily. Whatever else the release says about security, it says something about how fast internal agent usage is compounding at a company that started early.

Three findings that travel

The operational lessons Uber shared will be more useful to most companies than the code.

The first is that the workflow, not the individual tool call, is the unit of security. Attacks hide inside causally linked chains where every step looks reasonable on its own. A tool evaluating actions in isolation cannot catch them, which is a problem for the guardrail-per-call approach a lot of vendors are shipping.

The second is that credential leakage turned out to be a far more common operational problem than prompt injection. Prompt injection gets the conference talks and the research papers. What happens at scale is secrets walking out of the building inside agent sessions.

The third is approval fatigue. When a user is asked to approve 50 or more actions in a single session, Naga writes, human oversight becomes a rubber stamp. That finding does the most damage, because human-in-the-loop approval is the control almost every enterprise AI governance framework currently leans on. Uber's data suggests it stops working at exactly the point where agents get useful enough to run long sessions.

Why release it

Uber joined the Open Secure AI Alliance shortly before this release. The NVIDIA-led group launched in late July with dozens of inaugural partners, including Microsoft, IBM, Cloudflare, CrowdStrike, Palo Alto Networks, Red Hat, Hugging Face, and the Linux Foundation. Its organizing argument is that defenders need AI security tooling they can inspect, modify, and run themselves. OpenAI, Google, and Anthropic are not among the founding members.

The release also fills a gap in the timeline. When Uber described its Agentic Pods program earlier this summer, the story was about pushing agents out of engineering and into finance, legal, HR, and operations. Every one of those deployments widens the surface ADR now watches. Publishing the security layer a few weeks after publicizing the expansion is a sensible order to do things in, and more than most companies manage.

For everyone else, the practical value is ADR-Bench. Agent security has been an area with strong opinions and very little shared measurement. A benchmark built from real enterprise data, with its limits stated, gives teams something to test their own defenses against. The industry may or may not converge on it. Either way it beats arguing over vendor claims.