uber / ADR

ADR: Agentic AI Detection and Response

ADR (Agentic AI Detection and Response) is an enterprise security system for AI agents. It helps organizations secure employee-facing agents such as Cursor, Claude Code, and Codex, as well as customer-facing agents such as AI support agents. ADR is deployed in production at Uber, and the accompanying paper was accepted to MLSys 2026: Paper PDF · Slides PDF

ADR (Agentic AI Detection and Response) 是一套针对 AI Agent 的企业级安全系统。它旨在帮助企业保护面向员工的 Agent（如 Cursor、Claude Code 和 Codex）以及面向客户的 Agent（如 AI 客服）。ADR 目前已在 Uber 的生产环境中部署，其相关论文已被 MLSys 2026 会议录用：论文 PDF · 演示文稿 PDF

How ADR secures enterprise AI agents

ADR 如何保障企业级 AI Agent 的安全

ADR secures enterprise AI agents through four complementary capabilities: observing agent activity, evaluating defenses, detecting threats, and preventing unsafe actions.

ADR 通过四种互补的能力来保障企业级 AI Agent 的安全：观察 Agent 活动、评估防御能力、检测威胁以及阻止不安全操作。

ADR Observability: Understand what AI agents are doing and why. In production, ADR captures agent intent, tool use, and execution traces across 7+ AI coding tools on macOS, Linux, and Windows, as well as internal automation and customer-facing support agents.
ADR 可观测性： 理解 AI Agent 的行为及其动机。在生产环境中，ADR 能够捕获 macOS、Linux 和 Windows 上 7 种以上 AI 编程工具的 Agent 意图、工具使用情况和执行轨迹，同时也涵盖内部自动化流程和面向客户的客服 Agent。
ADR Benchmark: Test agent security under realistic enterprise conditions. ADR-Bench includes 300+ tasks, 133 MCP servers, and coverage of all 17 agent attack techniques.
ADR 基准测试： 在真实的企业环境下测试 Agent 的安全性。ADR-Bench 包含 300 多个任务、133 个 MCP 服务器，并覆盖了全部 17 种 Agent 攻击技术。
ADR Detection: Detect risky agent behavior efficiently. Its two-tier architecture combines high-recall triage with deeper agentic reasoning for suspicious sessions.
ADR 检测： 高效检测 Agent 的风险行为。其双层架构结合了高召回率的初步筛选与针对可疑会话的深度 Agent 推理。
ADR Prevention: Stop unsafe actions before they cause harm. This component is not included in the current open-source release. Stay tuned.
ADR 防御： 在不安全操作造成损害前将其阻止。该组件未包含在当前的开源版本中，敬请期待。

Repository layout

仓库结构

This repository contains the open-source ADR Sensor, ADR-Bench, and ADR Detector described in the paper. The offline ADR Explorer engine, which hardens ADR Detection through pre-deployment red teaming, is not included here.

本仓库包含论文中描述的开源 ADR Sensor、ADR-Bench 和 ADR Detector。用于通过部署前红队测试来强化 ADR 检测的离线 ADR Explorer 引擎未包含在此处。

Path	ADR component	Description
Path	ADR 组件	描述
Sensor/	ADR Observability	Collect and normalize agent telemetry from Claude Code, Cursor, Codex, and others
Sensor/	ADR 可观测性	收集并标准化来自 Claude Code、Cursor、Codex 等工具的 Agent 遥测数据
Detection/	ADR Benchmark + Detection	Dual-agent detector, 133 MCP servers, 303 benchmark tasks, baselines, figure scripts
Detection/	ADR 基准测试 + 检测	双 Agent 检测器、133 个 MCP 服务器、303 个基准测试任务、基准线及图表脚本
docs/REPRODUCIBILITY.md	Evaluation	Step-by-step workflow to reproduce benchmark detection and paper figures
docs/REPRODUCIBILITY.md	评估	复现基准测试检测结果和论文图表的详细工作流程

Quick start: ADR Detection

快速开始：ADR 检测

git clone https://github.com/uber/ADR
cd ADR/Detection
uv sync
export ANTHROPIC_API_KEY="..."
export OPENAI_API_KEY="..."

Default detector is adr (ADR dual-agent). For keyless smoke tests, use --detector llamafirewall (see Detection/README.md). See docs/REPRODUCIBILITY.md for the full evaluation workflow (inflate packed benchmark → run detectors → plot figures).

默认检测器为 adr（ADR 双 Agent）。如需进行无密钥冒烟测试，请使用 --detector llamafirewall（详见 Detection/README.md）。完整的评估工作流程（解压基准测试包 → 运行检测器 → 绘制图表）请参考 docs/REPRODUCIBILITY.md。

Component documentation:

组件文档：

Sensor/README.md: telemetry collection and unified schema
Sensor/README.md: 遥测数据收集与统一架构
Detection/README.md: ADR-Bench, detector baselines, MCP infrastructure
Detection/README.md: ADR-Bench、检测器基准线、MCP 基础设施

Citation

引用

@inproceedings{li2026adr,
  title={ADR: An Agentic Detection System for Enterprise Agentic AI Security},
  author={Li, Chenning and Hu, Pan and Xu, Justin and Ozbas, Baris and Liu, Olivia and Van, Caroline and Li, Manxue and Zhou, Wei and Alizadeh, Mohammad and Zhang, Pengyu and Sriramadhesikan, KK and Zhang, Ming},
  booktitle={Proceedings of the Ninth Conference on Machine Learning and Systems},
  year={2026}
}

Or use CITATION.cff. 或者使用 CITATION.cff。

License

许可证

Apache License 2.0. See LICENSE. Detection/benchmark/agentdojo/ is vendored third-party code under its own LICENSE (MIT). 采用 Apache License 2.0。详见 LICENSE。Detection/benchmark/agentdojo/ 为第三方代码，遵循其自身的 LICENSE (MIT)。

Data notice

数据声明

Detection/ includes synthetic benchmark fixtures (fake credentials, emulated environments, prompt-injection scenarios) for defensive security research only. Details: docs/OPEN_SOURCE_REVIEW.md. Detection/ 包含合成基准测试装置（虚假凭据、模拟环境、提示词注入场景），仅供防御性安全研究使用。详情请见：docs/OPEN_SOURCE_REVIEW.md。