Uber has open-sourced ADR, short for Agentic AI Detection and Response, a security system that monitors AI coding agents like Claude Code, Cursor, and Codex for risky behavior. Released on August 6, 2026 under the Apache 2.0 license, ADR gives teams a way to see and control what their agents actually do.

What Happened

After running ADR in production for more than ten months, Uber released it publicly alongside a research paper accepted to MLSys 2026. The system had already spread to over 7,200 unique hosts inside the company and, according to Uber, detected hundreds of credential exposures across 26 categories that had leaked outside the corporate network. The full technical writeup is on arXiv.

Why It Matters

Coding agents now read code, run commands, and call internal tools on real systems, which makes them powerful and hard to audit. If you or your team lean on Claude Code or Cursor for daily work, ADR is the first major open-source attempt to answer a basic question: what did the agent just do, and was any of it dangerous? For anyone building with AI agents at scale, that visibility has been the missing piece.

Key Details

  • Coverage: ADR captures agent intent, tool use, and execution traces across seven or more AI coding tools on macOS, Linux, and Windows.
  • Components: The release includes the ADR Sensor for telemetry, ADR-Bench for testing, and the ADR Detector for two-tier threat detection. The offline ADR Explorer red-teaming engine is not yet public.
  • Benchmark: ADR-Bench spans 302 tasks and 17 documented attack techniques. Uber reports zero false positives while catching 67 percent of attacks, beating three baselines by two to four times on F1 score.
  • Origin: Uber security engineer Praveen Neppalli framed the release around agents running 50,000-plus sessions per day, as he described on X.

What to Do Next

If your team runs coding agents beyond a single laptop, clone the repository and start with the ADR Sensor to baseline what your agents are doing before layering on detection. For solo creators, the more useful takeaway is awareness: agentic tools act on your machine and your credentials, so treat their permissions the way you would treat any script with shell access.