ADR is Uber’s open-source security system for enterprise AI agents, combining observability, benchmarking, and threat detection to help organizations understand and reduce agent risk.
ADR stands for Agentic AI Detection and Response, and it is presented as an enterprise security system for AI agents. The repository includes the open-source Sensor, ADR-Bench, and ADR Detector components, while the prevention-focused ADR Explorer and the ADR Prevention capability are not part of the current release. The README says it is already deployed in production at Uber and that the associated paper was accepted to MLSys 2026.
The project addresses the security risks of enterprise AI agents, including employee-facing tools like Cursor, Claude Code, and Codex, as well as customer-facing support agents. Its stated goal is to help organizations observe agent behavior, benchmark defenses under realistic conditions, and detect suspicious or unsafe actions before they cause harm.
Conceptually, ADR works through four linked functions: it observes agent activity, evaluates security defenses, detects threats, and is intended to prevent unsafe actions. The observable open-source parts focus on collecting and normalizing telemetry, running a benchmark with many tasks and MCP servers, and using a two-tier detection approach that first triages sessions and then applies deeper reasoning to suspicious ones. The README does not provide more implementation detail than that.
ADR is gaining attention because it sits at the intersection of AI agents, enterprise security, and threat detection, which are all active areas of interest. The repository also signals real-world maturity by stating that it is deployed at Uber, that its paper reached MLSys 2026, and that it covers a large benchmark with 300+ tasks and 133 MCP servers. Its recent star growth suggests strong current interest in practical agent-security tooling.
The README itself points to a key comparison point: a baseline detector called llamafirewall for smoke tests. More broadly, ADR-Bench appears to benchmark agent security against multiple detector baselines, but the README does not list all competing projects by name. So the clearest documented alternative here is the baseline detector used within the repository rather than a separate external tool.
AI-explained · grounded in each repo's README