Back to Devoured - August 06, 2026
DEVOURED
ADR (GitHub Repo)

ADR (GitHub Repo)

AI securityagents Github
Uber open-sourced ADR, an enterprise security suite designed to detect and prevent risky autonomous agent behavior in production environments.
What: ADR (Agentic AI Detection and Response) provides observability and threat detection for AI agents, including those used in coding (like Cursor or Claude Code) and customer support. The system includes ADR-Bench, which contains over 300 tasks and 133 MCP servers to test for 17 different agent attack techniques.
Why it matters: As autonomous agents move into production, standard network firewalls are insufficient; security teams need tools that understand the 'intent' behind agent tool usage and execution traces.
Takeaway: Developers using AI agents in sensitive environments can implement the ADR Sensor to capture telemetry and use ADR-Bench to validate their current defensive posture against known agentic attack vectors.
Deep dive
  • ADR is split into three functional pillars: Observability, Benchmarking, and Detection.
  • The tool supports deep visibility into coding agents on macOS, Linux, and Windows.
  • ADR-Bench acts as an adversarial testing ground using Model Context Protocol (MCP) servers.
  • The detection layer uses a two-tier architecture: high-recall triage followed by deeper model-based reasoning for suspicious activity.
  • The system is currently deployed in production at Uber.
Decoder
  • MCP (Model Context Protocol): An open standard that enables AI models to connect to external data sources and tools securely.
  • Red teaming: The practice of simulating adversarial attacks to identify vulnerabilities in a system.
Original article

ADR: Agentic AI Detection and Response

ADR (Agentic AI Detection and Response) is an enterprise security system for AI agents. It helps organizations secure employee-facing agents such as Cursor, Claude Code, and Codex, as well as customer-facing agents such as AI support agents.

ADR is deployed in production at Uber, and the accompanying paper was accepted to MLSys 2026.

How ADR secures enterprise AI agents

ADR secures enterprise AI agents through four complementary capabilities: observing agent activity, evaluating defenses, detecting threats, and preventing unsafe actions.

  1. ADR Observability: Understand what AI agents are doing and why. In production, ADR captures agent intent, tool use, and execution traces across 7+ AI coding tools on macOS, Linux, and Windows, as well as internal automation and customer-facing support agents.
  2. ADR Benchmark: Test agent security under realistic enterprise conditions. ADR-Bench includes 300+ tasks, 133 MCP servers, and coverage of all 17 agent attack techniques.
  3. ADR Detection: Detect risky agent behavior efficiently. Its two-tier architecture combines high-recall triage with deeper agentic reasoning for suspicious sessions.
  4. ADR Prevention: Stop unsafe actions before they cause harm. This component is not included in the current open-source release. Stay tuned.

Repository layout

This repository contains the open-source ADR Sensor, ADR-Bench, and ADR Detector described in the paper. The offline ADR Explorer engine, which hardens ADR Detection through pre-deployment red teaming, is not included here.

Path ADR component Description
Sensor/ ADR Observability Collect and normalize agent telemetry from Claude Code, Cursor, Codex, and others
Detection/ ADR Benchmark + Detection Dual-agent detector, 133 MCP servers, 303 benchmark tasks, baselines, figure scripts
docs/REPRODUCIBILITY.md Evaluation Step-by-step workflow to reproduce benchmark detection and paper figures

Quick start: ADR Detection

git clone https://github.com/uber/ADR
cd ADR/Detection
uv sync
export ANTHROPIC_API_KEY="..." OPENAI_API_KEY="..."

Default detector is adr (ADR dual-agent). For keyless smoke tests, use --detector llamafirewall.

See docs/REPRODUCIBILITY.md for the full evaluation workflow (inflate packed benchmark → run detectors → plot figures).

Component documentation:

  • Sensor/README.md: telemetry collection and unified schema
  • Detection/README.md: ADR-Bench, detector baselines, MCP infrastructure

Citation

@inproceedings{li2026adr,
  title={ADR: An Agentic Detection System for Enterprise Agentic AI Security},
  author={Li, Chenning and Hu, Pan and Xu, Justin and Ozbas, Baris and Liu, Olivia and Van, Caroline and Li, Manxue and Zhou, Wei and Alizadeh, Mohammad and Zhang, Pengyu and Sriramadhesikan, KK and Zhang, Ming},
  booktitle={Proceedings of the Ninth Conference on Machine Learning and Systems},
  year={2026}
}

License

Apache License 2.0. See LICENSE. Detection/benchmark/agentdojo/ is vendored third-party code under its own LICENSE (MIT).

Data notice

Detection/ includes synthetic benchmark fixtures (fake credentials, emulated environments, prompt-injection scenarios) for defensive security research only. Details: docs/OPEN_SOURCE_REVIEW.md.

Explore all 58 articles in today's digest

Fresh dev news, AI-digested daily. Never miss a trend at devoured.fyi