It’s 11 PM; do you know what your agents are up to?
Last week, Uber released as open source its home-built “enterprise security system” for AI agents, called Agentic AI Detection and Response (ADR).
The software tracks the behaviors of agents created by employees as well as customer-facing agents that power company chatbots, scanning for malicious activity and blocking unsafe actions.
Uber has used the technology in production for the past 10 months, where it helps manage the more than 50,000 agents the company now runs.
Agent Proliferation at Uber
The ride-sharing service’s use of agents exploded in 2025, from about 100 instances a day in May to more than 10,000 sessions a day by October. Agents now touch every part of the internal development lifecycle at Uber, from ideation, design, and development, to testing, reviewing, and deployment.
As the company learned with early OpenClaw deployments, agents come with their own set of security concerns. They can issue destructive commands, copy private data into public spaces such as GitHub, or collect unwarranted data about internal systems. Or, they could delete files they weren’t supposed to delete.
Traditional Endpoint Detection and Response (EDR) security software treats agents as black boxes, noted Uber CTO Praveen Neppalli in a LinkedIn post introducing the technology. Such software may log the files being written to, or the network calls being made, but not the prompt, nor the logic behind these actions.
“The intent, the thing that separates malicious from benign, is invisible,” Neppalli wrote.
Uber has over 30,000 possible agent endpoints, mostly in the form of the developers’ macOS and Linux laptops. Clearly, it would be prohibitively expensive to analyze each action with an LLM. ADR’s two-tier architecture executes high-recall triage, but saves deeper agentic reasoning only for suspicious sessions. Any action analyzed by an LLM is accompanied by source code, threat intel, and policy context.
Surface Scan then Deep Dive
Uber built software that looks into what the agent was getting into, documenting and analyzing every action in the agentic cycle: prompt, reasoning, tool calls to the final outcome. The workflow is the focus here, not the tool itself.
The company has found, for instance, that agents leaking company credentials was a common problem, more so than prompt injection. The software has found hundreds of cases of credential exposure.
The software put a halt to other questionable activities. It blocked 97.2% of secrets that were about to be copied out of the laptop. It blocked every attack from AgentDojo, a public prompt injection benchmark, with only three false alarms out of 93 tasks.
The package includes a detection framework and benchmarks designed specifically to test agentic AI security for the enterprise. The benchmark, called ADR-Bench, includes more than 300 tasks, 133 MCP servers, and covers all 17 known agent attack techniques.
The framework includes an observability component designed to understand what agents are doing and why. ADR captures traffic being generated across a variety of AI coding tools, covering macOS, Linux, and Windows platforms. Seven tools are supported initially.
There is also a prevention component to ADR, but that has not been released yet.
Uber has also joined the Open Secure AI Alliance (OSA), a recent initiative spearheaded by NVIDIA to build out an ecosystem of tools for detecting and blocking AI threats.
