Uber and MIT’s ADR: Defending AI Agents at the Speed of Risk

By

By the end of 2025, Uber employees were running more than 10,000 AI agent sessions a day. By 2026, per Uber’s MLSys 2026 talk, the number was over 200,000 a day. The first session was December 15, 2024: ten months from zero to 10,000 a day. And the agents doing that work do not just chat. They read code, run commands, call internal tools, and act on real systems.

That is the speed of adoption. The speed of risk is faster.

An agent does not deliberate like a human. A prompt, or a paragraph inside a file the agent was told to read, becomes a tool call in seconds: read .env, extract a token, ship it out through a Model Context Protocol (MCP) server. The whole chain can finish in the time it takes a defender to notice the alert that describes it. This is the gap that pushed Uber to block OpenClaw, to require security review before onboarding any new AI agent, and to build, with collaborators at MIT, a production system called ADR.

What ADR is

ADR — Agentic AI Detection and Response — is a security system for AI agents operating through MCP, the standard interface that lets agents call tools and read data. It was built by Uber’s security team in collaboration with MIT (co-author Mohammad Alizadeh is MIT faculty; co-author Chenning Li holds both MIT and Uber affiliations, with the paper noting the work was done during internships at Uber), ran in production at Uber for over ten months, and was open-sourced under Apache 2.0 when the paper was accepted at MLSys 2026 (Industry Track).

The paper is explicit about the three gaps that motivated it, and all three are about speed:

  1. Observability. EDR sees file writes and network calls, but not prompts, reasoning, or the causal chain linking intent to execution. If you cannot see why an agent did something, you can only review it after the fact.
  2. Evaluation. Existing benchmarks were not MCP-native, lacked enterprise policy context, and covered a narrow slice of the threat space. Static defenses constrained by pre-defined rules fail to generalize across attack techniques.
  3. Detection cost. LLM-based reasoning on every event is prohibitively expensive at production scale. At 10,000+ sessions a day you cannot afford to think deeply about everything.

ADR answers with three components. The ADR Sensor reconstructs the full causal chain — prompt, reasoning steps, tool calls, outcomes — across the coding agents employees actually use (Cursor, Claude Code, Codex, Gemini, Warp, Cline, and others) on macOS, Linux, and Windows. The ADR Detector uses a two-tier architecture: cheap, high-recall triage routes the huge benign majority, and deeper agentic reasoning with enterprise context runs only on the sessions that survive triage. The ADR Explorer is an offline red team that systematically generates and tests attack variants before deployment, feeding what it learns back into the detector. (The Explorer and the newer Prevention layer are not in the open-source release.)

Alongside it, ADR-Bench gives the field what it did not have: 302 tasks (42 malicious, 260 benign) derived from production experience across 133 MCP servers, covering all 17 attack techniques in a five-tactic taxonomy. On ADR-Bench, ADR achieved zero false positives while detecting 67% of attacks, outperforming three state-of-the-art baselines (ALRPHFS, GuardAgent, LlamaFirewall) by 2–4x in F1-score. On AgentDojo, the public prompt-injection benchmark, it caught every attack with three false alarms out of 93 tasks.

Read that 67% honestly: on its own benchmark, ADR misses a third of attacks. That is worth saying out loud, because the paper’s headline is the zero-false- positive half of the pair. But it is still the right trade, and the comparison that matters is not 67% against 100% — it is 67% against what the enterprise had before. The baselines ADR beats by 2–4x in F1 are the current state of the art, and the controls actually deployed in most organizations are worse than the baselines: EDR that sees the file write but not the reasoning, DLP that an agent walks through by writing software, and a human approving their fiftieth action of the session. Against that, catching two-thirds of attacks in the agent’s own loop, at a precision that does not train responders to ignore the alerts, is a real gain. The missing third is the honest measure of how early this field is — not a reason to keep waiting for the tool that catches everything.

Why Uber and MIT

The division of labor is visible in the paper itself. Uber brought what no lab can: 10,000-to-200,000 sessions a day of real telemetry, a fleet of roughly 30,000 macOS and Linux endpoints (per the talk), and the operational pressure of a security incident that had not happened yet. MIT brought what a production team rarely has time for: systematic evaluation, a defensible threat taxonomy, and the discipline of measuring a detector instead of shipping it.

The result is one system held to two bars. The engineering bar was deployment: ADR ran in production at Uber for over ten months, processing real sessions across roughly 30,000 macOS and Linux devpod endpoints before the paper was ever written. The research bar was peer review: an MLSys 2026 Industry Track acceptance, a public benchmark, and an open-source release so other organizations can evaluate their own defenses. That production-first trajectory — build it because the risk is real, prove it in your own environment, then publish — is the rare industry-academia collaboration that did not stop at a paper.

What ten months of production found

The headline findings are credential exposure. ADR uncovered hundreds of credential exposures across 26 categories — long-lived credentials shared with AI vendors, LLM providers, and MCP servers, plus secrets an agent read from .env files and configuration. A shift-left prevention layer built from those findings detected 206 credentials at 97.2% precision. That precision number matters: at 200,000 sessions a day, every percentage point of false positives is a flood of wasted incident-response hours.

Other findings are less flattering to our assumptions. Destructive commands were a real category — agents running privileged commands on the user’s identity, where built-in LLM guards cover rm -rf but miss internal tools and company-specific context. Data exfiltration bypassed DLP because agents write software that streams data out. And the human layer was not holding: users consistently ran YOLO mode without sandbox, approved 50+ actions per session, and approval fatigue meant approvals were not oversight.

The misconceptions are instructive too. Prompt injection, the attack that gets all the attention, was surprisingly rare in production — external-facing agents can be tricked, but their actions are easy to track. Supply chain attacks were not rare and were picking up: skills and packages that quietly collect information from developer environments. Uber’s response, per its MLSys talk, was an internal package registry with a delay and scanning of skills.

The speed of risk

Three speeds are in play here, and defenders are behind on all three.

Adoption outpaces policy. Ten months from first session to 10,000 a day, then another order of magnitude in the following year. Security review queues run on calendar time; agent adoption runs on compounding time. By the time a policy covers a tool, the fleet has moved on.

Execution outpaces review. An agent turns an instruction into a tool call in seconds, and a complete exfiltration chain fits inside a single session. The defender who reads the log afterward is a historian, not a control. This is why EDR — which reports outcomes — is structurally too slow for agents, and why ADR’s Sensor records the causal chain itself: to judge intent, you must be able to see the reasoning that produced the action.

Semantic attacks outpace signatures. The paper’s core insight is that attackers exploit a semantic gap: they craft attacks that look benign under superficial examination but are malicious once you understand intent and context. Rules and blocklists do not move at the speed of paraphrase. A defense that cannot reason about meaning will always be one rewrite behind.

The speed defenders must move

ADR’s design choices are, read correctly, a statement about how fast defense has to be:

  • Detection runs in the agent’s loop, not the incident queue. Telemetry of the causal chain is collected continuously; triage is cheap enough to run on every session.
  • Cost is a speed requirement. Deep reasoning on everything is too slow and too expensive at 200,000 sessions a day. The two-tier architecture is how real-time stays affordable: spend the expensive reasoning only where triage says it matters.
  • Precision is a speed requirement. False positives send defenders down rabbit holes and train users to ignore warnings. Precision-first design (zero false positives on ADR-Bench) is what makes machine-speed defense operable instead of noisy.
  • Harden before attackers arrive. The Explorer red-teams pre-deployment, so production detection ships already knowing the attack variants that matter, rather than learning them from the first incident.
  • Shift left. When you cannot outrun the attacker, you take the tool away before the action: prevention at 97.2% precision instead of detection after the fact.
  • Move humans up the stack. If people cannot meaningfully review 50 actions per session, the real-time controls belong in the execution path — sandboxes, scope verification, guardrails — and humans review policy and exceptions instead.

What this means for the rest of us

A few things to take from ADR, whether or not you deploy it:

  1. Your agents are already on the network. Uber’s first agent session predates most security policies. Inventory the causal chain you can actually observe before you need it.
  2. The EDR gap is real. Outcomes without reasoning are not enough to judge an agent’s actions. If you cannot reconstruct prompt-to-tool-call chains, you cannot defend them.
  3. The taxonomy is a checklist. Five tactics, seventeen techniques — initial access and execution, permission abuse, security control bypass, reasoning and data manipulation, operational impact. It is the most complete public map of the agentic threat space so far: 17 of 17 techniques, where the leading public benchmarks cover a handful (AgentDojo covers 4 of 17, RAS-Eval 3 of 17, per Uber’s talk). ADR-Bench is public, so you can evaluate defenses against enterprise-shaped tasks instead of toy ones.
  4. The open gaps are the business opportunity for security teams. The open-source release covers the Sensor, Detector, and benchmark; the Explorer and Prevention layers did not ship. Real-time guardrails that intervene before an agent executes are exactly what Uber’s own talk calls the open direction — and arguably the hardest open problem in agent security right now.

The takeaway from Uber and MIT’s ADR is uncomfortable but simple: the clock security teams defend on is no longer set by the attacker’s manual steps or the quarterly review cycle. It is set by the agent, and the agent acts in seconds. Defenses that cannot move at that speed are not slow — they are already obsolete.

Sources: Uber/ADR repository, the paper on arXiv, and Uber’s MLSys 2026 talk slides.