Uber ADR: The Open-Source Security Framework With 770+ GitHub Stars That Protects Enterprise AI Agents

If you're deploying AI coding agents in your organization — whether it's Cursor, Claude Code, GitHub Copilot, or Codex — you have a massive blind spot. These agents execute code, access APIs, and interact with your infrastructure autonomously. But who's watching the watchers?

That's the question Uber's ADR (Agentic AI Detection and Response) was built to answer. Now open-source and accepted at MLSys 2026, ADR gives enterprises the tools to observe, benchmark, and detect security threats in their AI agent fleet.

With 770+ GitHub stars and growing 150+ stars daily, ADR is quickly becoming the go-to security framework for teams taking AI agents from experiment to production.

What Is Uber ADR and Why Does It Matter?

ADR stands for Agentic AI Detection and Response. It's an enterprise-grade security system designed specifically for the new wave of AI coding agents that are transforming software development.

Unlike traditional application security tools, ADR understands the unique threat model of autonomous AI agents:

• Prompt injection attacks — malicious instructions hidden in codebases or documents
• Tool abuse — agents executing dangerous commands without proper authorization
• Data exfiltration — agents inadvertently leaking sensitive information through API calls
• Privilege escalation — agents gaining access beyond their intended scope

ADR is deployed in production at Uber, monitoring agents across macOS, Linux, and Windows — covering 7+ AI coding tools plus internal automation and customer-facing support agents.

The Four Pillars of ADR Security

ADR provides a comprehensive security posture through four complementary capabilities:

1. ADR Observability — See What Your Agents Are Doing

The ADR Sensor captures and normalizes agent telemetry into a unified schema. It tracks:

• Agent intent — what the agent was asked to do
• Tool usage — which tools and APIs the agent invoked
• Execution traces — the full chain of actions and decisions

# Clone and set up ADR Sensor
git clone https://github.com/uber/ADR
cd ADR/Sensor

# ADR Sensor supports multiple agent platforms:
# - Claude Code (Anthropic)
# - Cursor (AI code editor)
# - GitHub Copilot
# - Codex (OpenAI)
# - And more...

This observability layer is critical because most organizations deploy AI agents without any visibility into their runtime behavior. ADR Sensor changes that.

2. ADR Benchmark — Test Your Defenses Under Realistic Conditions

ADR-Bench is the most comprehensive AI agent security benchmark available, featuring:

• 303 benchmark tasks covering real-world attack scenarios
• 133 MCP servers simulating enterprise tool integrations
• All 17 known agent attack techniques from academic research

The benchmark includes synthetic fixtures — fake credentials, emulated environments, and prompt-injection scenarios — designed for defensive security research only.

3. ADR Detection — Two-Tier Threat Detection Architecture

ADR's detection system uses a sophisticated two-tier approach:

┌─────────────────────────────────────────────┐
│  Tier 1: High-Recall Triage                │
│  Fast screening of all agent sessions      │
│  Flags suspicious patterns for review      │
└──────────────────┬──────────────────────────┘
                   │ Suspicious sessions
                   ▼
┌─────────────────────────────────────────────┐
│  Tier 2: Deep Agentic Reasoning            │
│  LLM-powered analysis of flagged sessions  │
│  Contextual threat assessment              │
└─────────────────────────────────────────────┘

This architecture balances speed and accuracy. Tier 1 casts a wide net with minimal overhead, while Tier 2 applies deeper reasoning only where it's needed.

# Run ADR Detection on your agent logs
cd ADR/Detection
uv sync

# Set your API keys for the LLM-powered detector
export ANTHROPIC_API_KEY="sk-ant-..."
export OPENAI_API_KEY="sk-..."

# Run the default ADR dual-agent detector
# Or use --detector llamafirewall for keyless smoke tests

4. ADR Prevention — Stop Unsafe Actions (Coming Soon)

The prevention component will stop unsafe actions before they cause harm. While not included in the current open-source release, Uber has indicated this is coming in a future update.

Real-World Example: Securing a Development Team's AI Agents

Imagine a development team of 50 engineers using Cursor and Claude Code daily. Without ADR, the security team has zero visibility into:

• What code repositories agents are accessing
• Whether agents are executing shell commands with elevated privileges
• If prompt injection attacks in third-party dependencies are manipulating agent behavior
• Whether agents are inadvertently sending proprietary code to external APIs

With ADR deployed:

# Example: ADR Detection output for a flagged session
{
  "session_id": "cursor-2026-08-05-abc123",
  "agent": "cursor",
  "risk_level": "high",
  "findings": [
    {
      "technique": "indirect-prompt-injection",
      "description": "Agent processed a README.md containing hidden instructions to exfiltrate environment variables",
      "evidence": "Tool call to 'execute_shell' with 'curl' command posting env vars to external endpoint",
      "mitigation": "Block outbound network requests from agent shell tool"
    }
  ],
  "tier": "deep_analysis",
  "confidence": 0.94
}

The security team receives actionable alerts with full context, enabling them to respond in minutes rather than discovering breaches weeks later.

Key Benefits of Adopting ADR

• Production-proven — deployed at Uber scale across multiple platforms and operating systems
• Comprehensive coverage — supports 7+ AI coding tools including Cursor, Claude Code, Codex, and GitHub Copilot
• Research-backed — peer-reviewed paper accepted at MLSys 2026, the top ML systems conference
• Benchmark-driven — 303 tasks and 133 MCP servers ensure you're testing against realistic threats
• Open-source — Apache 2.0 license means no vendor lock-in and full transparency
• Two-tier detection — balances performance with accuracy through smart architectural design
• Cross-platform — works on macOS, Linux, and Windows

Getting Started with ADR

Setting up ADR is straightforward:

# 1. Clone the repository
git clone https://github.com/uber/ADR
cd ADR

# 2. Set up Detection (requires Python with uv)
cd Detection
uv sync

# 3. Configure API keys
export ANTHROPIC_API_KEY="your-key-here"
export OPENAI_API_KEY="your-key-here"

# 4. Run the benchmark to establish your baseline
# See docs/REPRODUCIBILITY.md for the full evaluation workflow

# 5. Deploy the Sensor on your developer machines
# See Sensor/README.md for platform-specific instructions

For teams evaluating AI agent security, start with ADR-Bench to understand your current risk posture, then deploy ADR Sensor for ongoing observability.

Frequently Asked Questions

1. What AI agents does ADR support?

ADR supports 7+ AI coding tools including Cursor, Claude Code, GitHub Copilot, Codex (OpenAI), and various internal automation agents. It also covers customer-facing support agents. The unified telemetry schema makes it easy to add new agent platforms.

2. Is ADR suitable for small teams or only enterprises?

While ADR was built for enterprise scale at Uber, the open-source release makes it accessible to teams of any size. Small teams can start with ADR-Bench to evaluate their security posture before deploying full observability. The keyless smoke test mode (--detector llamafirewall) requires no API keys.

3. How does ADR differ from traditional application security tools?

Traditional security tools focus on static code analysis, network monitoring, or runtime application protection. ADR is specifically designed for the unique threat model of autonomous AI agents — including prompt injection, tool abuse, and unintended data exfiltration through LLM-driven decision making.

4. What is the ADR-Bench benchmark and how can I use it?

ADR-Bench includes 303 security tasks, 133 simulated MCP servers, and covers all 17 known AI agent attack techniques. You can use it to evaluate your current agent security controls, compare different detection approaches, and establish security baselines before production deployment.

5. Does ADR prevent attacks or only detect them?

The current open-source release includes observability, benchmarking, and detection capabilities. The prevention component — which stops unsafe actions before they cause harm — is not yet open-sourced but Uber has indicated it's coming in a future release.

6. What operating systems does ADR support?

ADR works across macOS, Linux, and Windows. The Sensor component is designed to capture telemetry from AI agents running on any of these platforms, making it suitable for heterogeneous enterprise environments.

7. Is the ADR paper peer-reviewed?

Yes. The accompanying research paper, "ADR: An Agentic Detection System for Enterprise Agentic AI Security," was accepted at MLSys 2026 — the premier conference for machine learning systems. Both the paper and presentation slides are included in the repository.